FBI Shuts Down China‑Linked QTFY Hack Infrastructure Targeting U.S. Data

Washington – The Department of Justice announced Wednesday that federal agents have dismantled two illicit platforms, QScan and QTRouter, operated by the Chinese state‑backed group QTFY. The operation, coordinated with the FBI, aims to halt a pipeline used to infiltrate critical U.S. networks.

QTFY infrastructure exposed

The two servers, identified as QScan and QTRouter, were linked to Nanjing Xinjiuwei Network Technology Company. According to Reuters, the tools facilitated credential theft, lateral movement, and exfiltration of proprietary data from energy, telecom and health sectors.

Legal repercussions

Federal prosecutors have filed charges alleging conspiracy to commit computer fraud. The indictment cites ↓ 2 distinct hacking campaigns that compromised dozens of organizations since early 2023.

“The disruption of QTFY’s command‑and‑control nodes marks a decisive blow against state‑sponsored cyber espionage,” a DOJ spokesperson said.

Analysts warn that the takedown may push the group to adopt more decentralized tactics, heightening detection challenges for U.S. defenders. Continued vigilance is urged, especially as supply‑chain vulnerabilities persist. See Bloomberg for further analysis.

Reported by: Kaelen Frost

Lead Cybersecurity Analyst