FBI Disrupts China-Linked QTFY Infrastructure: Defending Against QScan and QTRouter Edge-Device Compromise

On Wednesday, the U.S. Department of Justice announced the disruption of two operational platforms — QScan and QTRouter — attributed to a Chinese state-sponsored threat group tracked as QTFY, operating through the front company Nanjing Xinjiuwei Network Technology Company (南京鑫玖维网络科技有限公司). The FBI's action seized or neutralized infrastructure used to target U.S. critical infrastructure and other sensitive networks for data theft.

Let me be direct: infrastructure takedowns are temporary victories. The operators behind QTFY are disciplined, well-resourced, and — critically — their tradecraft is already burned into environments that may not even know they're compromised. Disruption of C2 and operational platforms does not remove implants already sitting on your edge devices. If you operate routers, VPN concentrators, firewalls, or any internet-facing network appliance, you should treat this announcement as an active hunting trigger, not a news item to file away.

This post breaks down what we know about the QTFY toolset, how this class of operation works from a defender's perspective, and exactly what you should be hunting for today.

Technical Analysis

Who and What

• Threat actor: QTFY, attributed to Chinese state sponsorship
• Corporate front: Nanjing Xinjiuwei Network Technology Company — a familiar pattern where Chinese contractors and nominally private firms provide operational cover for state-directed intrusion activity (consistent with the contractor ecosystem exposed in prior i-Soon leaks and similar disclosures)
• Operational platforms disrupted:
  • QScan — a reconnaissance and scanning platform used to identify and enumerate vulnerable targets at scale, with a focus on critical infrastructure and sensitive networks
  • QTRouter — infrastructure leveraging compromised routers as operational relay boxes (ORBs), a technique Chinese state actors have refined over years to anonymize C2 traffic and stage intrusions from victim-owned devices
• Targeting: U.S. critical infrastructure and other sensitive networks, with data theft as the operational objective
• Exploitation status: This is confirmed, active, state-sponsored operations disrupted by federal law enforcement — not theoretical. The FBI action itself is evidence of in-the-wild compromise of U.S. organizations.

The Attack Pattern: Edge Devices as the Beachhead

While full technical details of QTFY's initial access vectors haven't been published in this announcement, the QTRouter component tells experienced responders almost everything we need to know about the tradecraft family. This is the same operational model we've responded to repeatedly across Chinese state-sponsored campaigns:

1. Compromise of edge and network devices. Small office/home office (SOHO) routers, enterprise VPN appliances, and firewalls are compromised via exploitation of known vulnerabilities, default credentials, or exposed management interfaces. These devices almost never run EDR, rarely ship logs anywhere, and are frequently unpatched for years.

2. Conversion to operational relay boxes. Once compromised, the router becomes a node in a covert relay network (the "QTRouter" function). Attack traffic to the next victim exits from a legitimate-looking U.S. or allied IP address — often another victim's device — defeating geofencing, ASN-based blocking, and lazy reputation filtering.

3. Scanning and victim enumeration via QScan. Target reconnaissance is pushed through the relay infrastructure, so the scan traffic your SOC sees never originates from a Chinese IP space. This is why perimeter rules like "block traffic from CN ASNs" are theater.

4. Persistent, low-noise access. Implants on edge devices are typically lightweight — modified firmware components, scheduled tasks, or dropped binaries in writable filesystem partitions — designed to survive reboots and avoid the device administrator entirely.

5. Data staging and exfiltration through the same relay mesh, blending with legitimate traffic.

The critical defensive implication: your network perimeter devices are both the target and the weapon. A compromised router in your environment may be simultaneously exfiltrating your data and serving as a launchpad against someone else — which also creates legal and reputational exposure.

Detection & Response

This is a nation-state intrusion campaign — a technical threat. The detections below target the observable behaviors of this tradecraft: anomalous scanning activity, suspicious processes and connections on network appliances, and edge-device persistence indicators.

Sigma Rules

These rules target behaviors visible on endpoints and systems adjacent to the edge-device compromise chain — unexpected scanning tool execution, anomalous outbound connections from network device management hosts, and suspicious tunneling utility usage consistent with ORB-style relay behavior.

---
title: Internal Network Scanning from Non-Scanner Hosts
title_note: QScan-style reconnaissance behavior
id: 3f8c1a92-6b4d-4e7a-9c21-0d5e8f2a1b34
status: experimental
description: Detects execution of network scanning utilities from hosts that are not authorized vulnerability scanners, consistent with state-sponsored reconnaissance platforms such as QScan enumerating internal networks after initial compromise.
references:
  - https://thehackernews.com/2026/08/fbi-disrupts-china-linked-qtfy.html
  - https://attack.mitre.org/techniques/T1046/
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.discovery
  - attack.t1046
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\nmap.exe'
      - '\masscan.exe'
      - '\zmap.exe'
      - '\nbtscan.exe'
      - '\angryip.exe'
  selection_cmdline:
    CommandLine|contains:
      - '-sn '
      - '-sS '
      - '-p-'
      - '--rate'
      - '/24'
  condition: selection_tool or (selection_cmdline and selection_tool)
falsepositives:
  - Authorized vulnerability management scans (whitelist scanner hosts by Computer name)
  - Network administration activity from jump boxes
level: high
---
title: Suspicious Tunneling or Proxy Utility Execution
title_note: ORB/QTRouter-style relay behavior
id: 9b2e4d71-3c8f-4a56-b7d2-1e6f0a9c5d82
status: experimental
description: Detects execution of common tunneling and proxy tools frequently abused by state-sponsored actors to relay C2 traffic through compromised infrastructure, consistent with QTRouter-style operational relay box behavior.
references:
  - https://thehackernews.com/2026/08/fbi-disrupts-china-linked-qtfy.html
  - https://attack.mitre.org/techniques/T1090/
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.command_and_control
  - attack.t1090
  - attack.t1572
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\frpc.exe'
      - '\frps.exe'
      - '\chisel.exe'
      - '\ligolo.exe'
      - '\ngrok.exe'
      - '\gost.exe'
      - '\rinetd.exe'
      - '\socat.exe'
  selection_iox:
    CommandLine|contains:
      - 'socks5'
      - 'socks4'
      - 'reverse_tunnel'
      - 'R:socks'
  condition: selection_image or (selection_iox and selection_image)
falsepositives:
  - Legitimate penetration testing engagements (verify against authorized activity windows)
  - Developer use of ngrok for tunneling (rare in production; investigate)
level: high
---
title: Outbound Connection from Network Management Host to Rare External IP
title_note: Edge device C2 staging indicator
id: 5c7a3f18-2d9b-4e64-a8c3-7f1d0b6e9a45
status: experimental
description: Detects outbound network connections from dedicated network device management or jump hosts to external destinations, which may indicate staging of compromised edge device traffic or management-plane abuse consistent with router relay operations.
references:
  - https://thehackernews.com/2026/08/fbi-disrupts-china-linked-qtfy.html
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationIp|cidr:
      - '0.0.0.0/0'
  filter_rfc1918:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '169.254.0.0/16'
  filter_loopback:
    DestinationIp|cidr:
      - '127.0.0.0/8'
  condition: selection and not filter_rfc1918 and not filter_loopback
falsepositives:
  - Firmware update checks and vendor telemetry from management hosts (baseline destination IPs per host and alert on new destinations only)
level: medium

A note on tuning: the third rule is intentionally scoped to dedicated management/jump hosts — deploy it against a small, known set of systems (your TACACS+/AAA jump boxes, NMS servers) where outbound internet traffic should be rare and predictable. Do not deploy it estate-wide.

KQL — Microsoft Sentinel / Defender

This hunt query surfaces outbound connections from hosts to IP addresses with low prevalence in your environment — the core analytic for catching ORB-relayed C2, since QTRouter traffic will come from residential/ISP IP space rather than known-bad infrastructure. It joins network events against a 30-day baseline to surface new destinations.

// Hunt: New low-prevalence external destinations from servers and management hosts
// Targets QTRouter-style ORB relay C2 that evades IP reputation feeds
let lookback = 30d;
let window = 7d;
let baseline = DeviceNetworkEvents
    | where TimeGenerated between (ago(lookback) .. ago(window))
    | where RemoteIPType == "Public"
    | summarize BaselineCount = count() by RemoteIP;
DeviceNetworkEvents
| where TimeGenerated > ago(window)
| where RemoteIPType == "Public"
| where DeviceName has_any ("mgmt", "jump", "nms", "netops", "fw", "vpn")  // tune to your naming convention
| where ActionType == "ConnectionSuccess"
| summarize RecentConnections = count(),
            FirstSeenInWindow = min(TimeGenerated),
            LastSeen = max(TimeGenerated),
            Processes = make_set(InitiatingProcessFileName, 5),
            Ports = make_set(RemotePort, 5)
    by DeviceName, RemoteIP, RemoteUrl
| join kind=leftanti baseline on RemoteIP   // keep only destinations NOT seen in prior 30 days
| sort by RecentConnections asc
| project FirstSeenInWindow, LastSeen, DeviceName, RemoteIP, RemoteUrl, RecentConnections, Ports, Processes

Supplementary Syslog hunt for edge devices forwarding logs (routers, firewalls, VPN appliances ingested via CEF/Syslog) — looking for configuration changes and new administrative sessions outside change windows, a hallmark of router implant deployment:

// Hunt: Edge device config changes and interactive logins (routers/firewalls/VPNs via CEF/Syslog)
// QTFY-style router implants typically follow a config or credential modification event
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DeviceVendor has_any ("Cisco", "Fortinet", "Palo Alto", "Juniper", "MikroTik", "SonicWall", "Ubiquiti")  // extend as needed
| where Message has_any ("configured", "configuration changed", "user added", "local user", "new account", "privilege")
   or (Activity has_any ("login", "Logon") and DeviceEventClassID has_any ("success", "0"))
| summarize Events = count(),
            SampleMessages = make_set(Message, 3),
            SourceUsers = make_set(SourceUserName, 5)
    by DeviceName, SourceIP, DestinationHostName, bin(TimeGenerated, 1h)
| sort by TimeGenerated desc

Velociraptor VQL

For endpoints that may have served as staging points, and for hunting persistence artifacts consistent with this tradecraft on reachable infrastructure:

-- Hunt for tunneling/proxy tooling and suspicious processes on endpoints
-- Targets ORB-style relay utilities observed in state-sponsored relay infrastructure
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime,
       hash(path=Exe) AS ExeHash
FROM pslist()
WHERE CommandLine =~ '(?i)(frpc|frps|chisel|ligolo|gost|ngrok|socat|rinetd|socks5|reverse.?tunnel)'
   OR Exe =~ '(?i)(temp|tmp|appdata|programdata)\\\\(frpc|frps|chisel|gost|socat)'
   OR (Name =~ '(?i)(svchost|csrss|lsass)\\.exe' AND Exe !~ '(?i)system32')

-- Hunt for recently modified scheduled tasks and run-key persistence
-- Common persistence layer after edge-adjacent compromise for staging hosts
SELECT Name, Command, FullPath, Mtime AS Modified
FROM glob(globs=['C:/Windows/System32/Tasks/**'], accessor='ntfs')
WHERE Mtime > now() - 604800   -- tasks modified in last 7 days
  AND FullPath !~ '(?i)(Microsoft\\\\Windows)'   -- exclude stock OS tasks
ORDER BY Modified DESC

Hardening & Verification Script (Bash — Linux/Network Device Infrastructure)

This script audits Linux-based management hosts and reachable network-adjacent systems for the persistence and relay indicators associated with this tradecraft, and verifies outbound connection hygiene. Run it from your management jump box against edge infrastructure where you have shell access.

#!/bin/bash
# qtfy-edge-audit.sh — Audit for ORB/relay tradecraft and edge persistence indicators
# Security Arsenal — run with sufficient privileges; review before executing in production

REPORT="/tmp/edge_audit_$(date +%Y%m%d_%H%M%S).log"
echo "=== QTFY-Tradecraft Edge Audit — $(hostname) — $(date) ===" | tee "$REPORT"

echo -e "\n[1] Suspicious tunneling/proxy processes" | tee -a "$REPORT"
ps auxww | grep -Ei 'frpc|frps|chisel|ligolo|gost|ngrok|socat|rinetd|iodine|dnscat' | grep -v grep | tee -a "$REPORT"

echo -e "\n[2] Processes executing from writable/temp paths" | tee -a "$REPORT"
ls -l /proc/*/exe 2>/dev/null | grep -E '/tmp/|/var/tmp/|/dev/shm/|/run/user/' | tee -a "$REPORT"

echo -e "\n[3] Crontab and systemd timer persistence" | tee -a "$REPORT"
crontab -l 2>/dev/null | tee -a "$REPORT"
ls -la /etc/cron.d/ /etc/cron.hourly/ /var/spool/cron/ 2>/dev/null | tee -a "$REPORT"
systemctl list-timers --all --no-pager 2>/dev/null | tee -a "$REPORT"

echo -e "\n[4] Unexpected listening sockets and outbound connections" | tee -a "$REPORT"
ss -tulnp 2>/dev/null | tee -a "$REPORT"
echo "--- Established outbound (non-standard ports) ---" | tee -a "$REPORT"
ss -tnp state established 2>/dev/null | awk '$4 !~ /:22$|:53$|:123$|:443$/ && NR>1' | tee -a "$REPORT"

echo -e "\n[5] Local user accounts with UID 0 or recent additions" | tee -a "$REPORT"
awk -F: '$3==0 {print}' /etc/passwd | tee -a "$REPORT"
awk -F: '$3>=1000 {print $1" (uid "$3")"}' /etc/passwd | tee -a "$REPORT"

echo -e "\n[6] Recently modified files in /etc and /boot (last 14 days)" | tee -a "$REPORT"
find /etc /boot -type f -mtime -14 2>/dev/null | head -50 | tee -a "$REPORT"

echo -e "\n[7] SSH authorized_keys with recent modification" | tee -a "$REPORT"
find /root /home -name authorized_keys -mtime -30 2>/dev/null | tee -a "$REPORT"

echo -e "\n[8] Verify rsyslog/syslog-ng remote forwarding is intact (log anti-tamper)" | tee -a "$REPORT"
grep -rE '@@?[0-9]+\.' /etc/rsyslog.conf /etc/rsyslog.d/ 2>/dev/null | tee -a "$REPORT"

echo -e "\n=== Audit complete. Review $REPORT and escalate anomalies to IR. ==="

For the network devices themselves (Cisco IOS/IOS XE, FortiGate, etc.), pull and review running configs against known-good baselines, verify firmware integrity against vendor-published hashes, and check for unauthorized local accounts — QTFY-class implants routinely add hidden admin users and modify boot configurations. CISA and the NSA have published joint guidance on router/edge device hardening that applies directly here; treat it as required reading this week.

Remediation

There is no single patch for a threat actor — remediation here is a program of work, prioritized by exposure:

1. Assume breach on edge devices. If your routers, VPN concentrators, or firewalls are more than one firmware revision behind, or if management interfaces were ever internet-exposed, schedule forensic review now. Pull configs, compare against baselines, verify firmware hashes against vendor-published values, and audit all local/RADIUS/TACACS+ accounts — including disabled and hidden ones.

2. Remove management interfaces from the internet. This remains the single highest-yield action. Edge device admin planes should be reachable only from a dedicated, authenticated management network or jump host. Audit with external scanning to confirm — don't trust the config, verify the exposure.

3. Patch internet-facing appliances aggressively. QTFY-class actors overwhelmingly gain initial access through known-vulnerable edge devices. Establish a 72-hour SLA for critical edge device firmware updates and subscribe to vendor PSIRT feeds plus the CISA KEV catalog.

4. Centralize network device logging. Forward syslog from every router, firewall, and VPN appliance to your SIEM with NTP synchronized. Alert on log gaps — a device that stops logging is a device worth investigating. Monitor for config changes, new local accounts, and interactive logins outside change windows.

5. Deploy the detection content above. Run the Sentinel prevalence hunt weekly; scope the Sigma rules to your management infrastructure. Build the baseline of "normal outbound destinations per management host" — that baseline is what turns QTRouter-style relay traffic from invisible to glaring.

6. Egress filtering with teeth. Default-deny outbound from server VLANs and management networks. State-sponsored relay traffic depends on arbitrary outbound connectivity; deny it.

7. Engage federal resources. If you identify compromise consistent with this activity, report to CISA (report@cisa.gov / cisa.gov/report) and your local FBI field office. The DOJ disruption means law enforcement has visibility into portions of this infrastructure — your telemetry may connect directly to an active federal investigation, and victim reporting materially shapes follow-on operations.

8. Watch for infrastructure regeneration. Takedowns displace; they rarely destroy. Expect QTFY or successor infrastructure to re-emerge under new names and front companies. Keep the behavioral detections running long after the headlines fade — behavior survives rebranding.

The Bottom Line

The FBI's disruption of QScan and QTRouter is a meaningful operational win, but no takedown removes implants from compromised routers or restores already-stolen data. The enduring lesson is the one this industry keeps relearning the hard way: edge devices are unmonitored, unpatched, and trusted — which is precisely why Chinese state actors keep building relay networks out of them. If your SOC has excellent EDR coverage on endpoints and near-zero visibility into the devices that connect those endpoints to the internet, you have a QTFY-shaped blind spot. Close it this quarter, not after the next disruption announcement.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub