U.S. Authorities Disrupt Chinese State-Sponsored Hacking Platforms QScan and QTRouter The U.S. Justice Department and FBI have seized domains linked to two China-based hacking platforms, QScan and QTRouter, in a court-authorized operation targeting cyber threats to critical infrastructure and government networks. The platforms were operated by QTFY, a state-sponsored group affiliated with Nanjing Xinjiuwei Network Technology Company, which allegedly provides offensive cyber services to China’s Ministry of State Security and People’s Liberation Army. QTFY’s activities compromised high-profile U.S. targets, including NASA, the Federal Reserve, the Department of Energy, the Department of Justice, the Department of Health and Human Services, the National Institutes of Health, and the U.S. Senate. The group employed an infrastructure-as-a-service model, using QScan to scan and exploit vulnerable IoT devices at scale. Compromised devices were then enrolled in QTRouter, a network of hijacked IoT hardware, proxy services, and virtual private servers that masked malicious traffic by routing it through seemingly legitimate systems outside China. This proxy-based architecture complicated attribution, as security teams often traced attacks to local IP addresses or consumer devices rather than the actual threat actors. The seized domains were hard-coded into the malware, and their takedown rendered the platforms inoperable, disrupting QTFY’s ability to control infected devices. The operation follows previous U.S. efforts to dismantle China-linked cyber threats, including the 2025 removal of PlugX malware from U.S. systems, the 2024 disruption of the Flax Typhoon IoT botnet, and the 2023 takedown of Volt Typhoon infrastructure. The FBI and NSA also released a cybersecurity advisory detailing QTFY’s indicators of compromise, with activity dating back to at least 2018. The seizure demonstrates how targeting domain-based infrastructure can disrupt state-backed cyber operations, even when attackers leverage distributed, compromised devices.