Posted on

QTFY QScan and QTRouter – China-Linked Critical Infrastructure Intrusion Hunt

Threat Overview

On August 26, 2026, the FBI, NSA, and Cyber National Mission Force published a joint advisory warning of ongoing activity by the China-linked group QTFY, also referred to as QT or QTCYBER. The same day, the U.S. Department of Justice announced court-authorized seizures of domains supporting QScan and QTRouter, which it said rendered those specific platforms inoperable because hard-coded domains were required for communication and authentication.

The government advisory describes QScan as a vulnerability scanning and exploitation platform used to identify weaknesses and compromise Internet of Things devices. QTRouter is an obfuscation network that uses compromised systems and routers, including devices running customized OpenWrt, to make malicious activity appear to originate from non-PRC or even locally proximate infrastructure. QTFY also operated botnet management platforms used to add compromised IoT devices as proxy nodes.

The agencies state that QTFY has used zero-day and N-day vulnerabilities, exploited Internet-facing appliances, obtained legitimate credentials from compromised systems for persistence, and targeted defense industrial base, communications, government, energy, information technology, water/wastewater, and higher-education environments. The advisory documents exploitation of Pulse Secure, Fortinet FortiOS SSL VPN, Citrix ADC/Gateway, Microsoft Exchange ProxyLogon, F5 BIG-IP, Log4Shell, Atlassian Confluence, Ivanti devices, and Check Point Quantum Gateway CVE-2024-24919 across historical operations.

The indicators used below are a limited subset of infrastructure published in the joint advisory. The advisory explicitly warns that some indicators are historical and recommends investigation or vetting before blocking.

References

Impacted Systems

  • Threat group: QTFY / QT / QTCYBER, attributed by U.S. government agencies to Nanjing Xinjiuwei Network Technology Co.
  • Primary platforms: QScan vulnerability scanning/exploitation platform; QTRouter traffic-obfuscation network; related botnet management platforms.
  • Targeted environments: Internet-facing edge appliances, VPNs, routers, IoT devices, and enterprise networks.
  • Sectors explicitly highlighted by the advisory: government, defense industrial base, communications, energy, information technology, water/wastewater, and higher education.
  • Platform examples in historical activity: Pulse Secure VPN, Fortinet FortiOS SSL VPN, Citrix ADC/Gateway, Microsoft Exchange, F5 BIG-IP, Atlassian Confluence, Ivanti management devices, Check Point Quantum Gateway, and IoT/router devices.
  • Attacker prerequisite: network reachability to exploitable edge/Internet-facing services or compromised credentials obtained after initial access.
  • Exposure condition: unpatched Internet-facing devices, weakly isolated edge systems, or compromised devices that can be incorporated into proxy infrastructure.
  • Current platform status: DOJ states the seized hard-coded QScan/QTRouter domains made those specific platforms inoperable. This does not mean all QTFY infrastructure, access, malware, or tradecraft is eliminated.

Why this matters

QTFY combines broad vulnerability scanning, exploitation of edge infrastructure, credential theft, persistence, and traffic obfuscation using compromised devices. Those behaviors are highly relevant to MSSP customers with network security, firewall, DNS, Syslog, endpoint, or edge-device telemetry in Sentinel.

Exploitation Status

Confirmed long-running malicious cyber activity. The joint advisory is based on incident response and investigative data. DOJ confirmed domain seizures on August 26, 2026. The advisory states that QTFY has exploited both zero-day and known vulnerabilities and has compromised sensitive U.S. and foreign organizations.

What this hunt looks for

A subset of published QTFY infrastructure, high-fan-out scanning, newly seen external sources, repeated edge-device access, outbound communications to published infrastructure, and QTFY product/infrastructure strings in network and system telemetry.

Required logs

  • CommonSecurityLog
  • DnsEvents or ASimDnsActivityLogs
  • DeviceNetworkEvents
  • Syslog

Hunt 1 – First-Pass: Published QTFY Infrastructure in Network Security Logs

let QTFYIPs = dynamic(["1.32.216.171","8.148.149.147","45.202.210.27","23.95.220.192","103.201.131.121","109.236.48.121"]);
let QTFYDomains = dynamic(["jump.qt-proxy.org","jump.qt-team.com","securelink.qtproxy.xyz","www.qtproxy.xyz","install.anticonstitutionally.sbs","mail.fastsecurey.info"]);
CommonSecurityLog
| where TimeGenerated >= ago(90d)
| extend Url=tostring(column_ifexists("RequestURL",""))
| where SourceIP in (QTFYIPs) or DestinationIP in (QTFYIPs) or DestinationHostName in~ (QTFYDomains) or Url has_any (QTFYDomains)
| project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, SourcePort, DestinationIP, DestinationPort, DestinationHostName, Url, DeviceAction, Message
| sort by TimeGenerated asc

Hunt 2 – Published QTFY Domains in DNS Telemetry

let QTFYDomains = dynamic(["jump.qt-proxy.org","jump.qt-team.com","securelink.qtproxy.xyz","www.qtproxy.xyz","install.anticonstitutionally.sbs","mail.fastsecurey.info"]);
union isfuzzy=true
(
    DnsEvents
    | project TimeGenerated, ClientIP, QueryName=Name, SourceTable="DnsEvents"
),
(
    ASimDnsActivityLogs
    | project TimeGenerated, ClientIP=SrcIpAddr, QueryName=DnsQuery, SourceTable="ASimDnsActivityLogs"
)
| where QueryName in~ (QTFYDomains)
| project TimeGenerated, SourceTable, ClientIP, QueryName
| sort by TimeGenerated asc

Hunt 3 – High-Fan-Out External Scanning Against Edge Infrastructure

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| summarize Events=count(), DestinationIPs=dcount(DestinationIP), DestinationPorts=dcount(DestinationPort), SamplePorts=make_set(DestinationPort,30), Actions=make_set(DeviceAction,20) by SourceIP, bin(TimeGenerated,15m)
| where DestinationIPs >= 10 or DestinationPorts >= 20 or Events >= 200
| sort by Events desc

Hunt 4 – Repeated Access From a New External Source to Edge Devices

let Baseline = CommonSecurityLog
| where TimeGenerated between (ago(30d) .. ago(7d))
| summarize by SourceIP, DestinationIP;
CommonSecurityLog
| where TimeGenerated >= ago(7d)
| join kind=leftanti Baseline on SourceIP, DestinationIP
| summarize Events=count(), Ports=make_set(DestinationPort,30), Actions=make_set(DeviceAction,20), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP, DestinationIP
| where Events >= 10
| sort by FirstSeen desc

Hunt 5 – Outbound Connections From Network or Edge Systems to QTFY Infrastructure

let QTFYIPs = dynamic(["1.32.216.171","8.148.149.147","45.202.210.27","23.95.220.192","103.201.131.121","109.236.48.121"]);
let QTFYDomains = dynamic(["jump.qt-proxy.org","jump.qt-team.com","securelink.qtproxy.xyz","www.qtproxy.xyz","install.anticonstitutionally.sbs","mail.fastsecurey.info"]);
DeviceNetworkEvents
| where TimeGenerated >= ago(90d)
| where RemoteIP in (QTFYIPs) or RemoteUrl in~ (QTFYDomains)
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, LocalIP, RemoteIP, RemoteUrl, RemotePort, ActionType
| sort by TimeGenerated asc

Hunt 6 – Network Device Syslog for QTFY Product or Infrastructure Strings

Syslog
| where TimeGenerated >= ago(90d)
| where SyslogMessage has_any ("QScan","QTRouter","QTBotnet","qt-proxy","qtproxy","qt-team","anticonstitutionally","fastsecurey")
| project TimeGenerated, Computer, HostIP, ProcessName, SeverityLevel, SyslogMessage
| sort by TimeGenerated asc

Hunt 7 – Rare New External Sources With Broad Port Access

let Baseline = CommonSecurityLog
| where TimeGenerated between (ago(30d) .. ago(7d))
| summarize by SourceIP;
CommonSecurityLog
| where TimeGenerated >= ago(7d)
| join kind=leftanti Baseline on SourceIP
| summarize Events=count(), Destinations=dcount(DestinationIP), Ports=dcount(DestinationPort), SampleDestinations=make_set(DestinationIP,20), SamplePorts=make_set(DestinationPort,30) by SourceIP
| where Destinations >= 5 and Ports >= 5
| sort by Events desc

Hunt 8 – Published QTFY Infrastructure Across Defender Network Telemetry

let QTFYIPs = dynamic(["1.32.216.171","8.148.149.147","45.202.210.27","23.95.220.192","103.201.131.121","109.236.48.121"]);
let QTFYDomains = dynamic(["jump.qt-proxy.org","jump.qt-team.com","securelink.qtproxy.xyz","www.qtproxy.xyz","install.anticonstitutionally.sbs","mail.fastsecurey.info"]);
DeviceNetworkEvents
| where TimeGenerated >= ago(90d)
| where RemoteIP in (QTFYIPs) or RemoteUrl in~ (QTFYDomains)
| summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Devices=make_set(DeviceName,50), Processes=make_set(InitiatingProcessFileName,30) by RemoteIP, RemoteUrl, RemotePort
| sort by LastSeen desc

Detection Notes

  • The exact IP/domain indicators are a limited subset from the government advisory, not the complete IOC package.
  • The joint advisory cautions that some infrastructure indicators are historical. Investigate and validate before blocking or attributing.
  • QTRouter was specifically designed to make intrusion traffic appear to originate from proxy nodes outside the PRC and potentially near a target, so country-based filtering is weak.
  • High-fan-out scanning is behavioral and can overlap with vulnerability scanners, penetration testing, CDN/security providers, and normal administrative activity.
  • Domain seizures reduced the utility of the seized infrastructure, but previously compromised devices, stolen credentials, alternate tooling, or successor infrastructure may remain relevant.
  • CommonSecurityLog field population varies by vendor and parser. The queries use broadly established fields but should be validated against the specific connector schema.
  • DNS hunts require DnsEvents or ASimDnsActivityLogs; endpoint IOC hunts require Defender network telemetry; Syslog fallback requires relevant network or appliance logs.

Leave a comment