FBI and DOJ Seize Chinese Proxy Platforms Used for State-Sponsored Espionage

The disruption of QScan and QTRouter highlights the ongoing battle against cyber espionage, particularly from state-sponsored actors like China.

• On August 26, 2026, the DOJ and FBI announced the seizure of domains linked to QScan and QTRouter, platforms used for espionage.
• Nanjing Xinjiuwei, the operator, provided services to Chinese state entities, facilitating attacks against U.S. agencies since at least 2018.
• The operation aimed to degrade the group's ability to mask their cyber activities through compromised devices.

• Chinese state-sponsored cyber operations have increasingly utilized private contractors for infrastructure, complicating attribution and response.
• QTFY's platforms were integral in obscuring the origins of attacks, evolving from IoT botnets to co-opting VPN services.
• This disruption follows previous actions against groups like Volt Typhoon, indicating a sustained U.S. strategy to counteract Chinese cyber threats.

On August 26, 2026, the U.S. Department of Justice (DOJ) and the Federal Bureau of Investigation (FBI) executed a significant cyber disruption operation against QScan and QTRouter, two proxy and scanning platforms operated by Nanjing Xinjiuwei Network Technology Company. These platforms were integral to the Chinese state-sponsored group QTFY, which has been linked to espionage campaigns targeting U.S. government agencies and critical infrastructure since at least 2018.

The operation involved the seizure of three domains—qtproxy.xyz, qt-proxy.org, and qt-team.com—hardcoded into the QScan and QTRouter systems. QScan was designed to scan for and exploit vulnerabilities in Internet of Things (IoT) devices, effectively building botnets that could be used for various malicious activities. Meanwhile, QTRouter facilitated the routing of malicious traffic through compromised devices and proxies, further obscuring the origins of cyberattacks.

The implications of this operation are significant. By disrupting these platforms, the DOJ and FBI aim to degrade the capabilities of QTFY, making it more challenging for them to conduct espionage without detection. This is particularly relevant given that QTFY has been linked to attacks against high-profile U.S. entities, including NASA, the Federal Reserve, and the Department of Energy. In 2024 alone, QScan processed over 2 million scanning and exploit tasks, underscoring the scale of its operations.

The broader context reveals a pattern of Chinese state-sponsored cyber operations increasingly relying on private contractors for infrastructure and tools. This trend complicates the attribution of cyberattacks and poses challenges for international cybersecurity efforts. The U.S. has been ramping up its countermeasures against these threats, as evidenced by this operation and previous disruptions of groups like Volt Typhoon.

Despite the success of this operation, experts anticipate that QTFY will adapt and pivot to new infrastructure, indicating that the threat landscape will continue to evolve. The Chinese Ministry of Foreign Affairs has denied the allegations, labeling them as false information, which reflects the ongoing geopolitical tensions surrounding cyber operations.

• Cybersecurity professionals: Increased scrutiny and demand for advanced defenses against state-sponsored threats.
• Government agencies: Heightened awareness and potential resource allocation for cybersecurity measures.
• Private sector companies: Those in critical infrastructure may face increased regulatory pressure to bolster defenses.

• New infrastructure developments: Monitor for signs of QTFY or similar groups adapting their operations to new platforms.
• Legislative changes: Watch for potential new cybersecurity regulations aimed at enhancing defenses against state-sponsored threats.
• International responses: Observe how other nations, particularly allies, react to U.S. actions against Chinese cyber operations.