Story perspectives

DOJ Disables Chinese QTFY Hacking Domains Targeting Federal Agencies

8/27/2026

Summary

DOJ Disrupts Chinese Hackers

U.S. Justice Department disrupted a Chinese state-sponsored hacking operation targeting federal agencies.
The DOJ seized and disabled the QScan and QTRouter domains used by the hackers.
QTFY, operated by Nanjing Xinjiuwei Network Technology, provided services to China’s Ministry of State Security and PLA.
The botnet targeted the DOJ, NASA, the Federal Reserve, Senate, Energy, HHS, NIH and DOE labs.

Summary

QTFY Botnet Resurges

QTFY’s QScan malware infected thousands of IoT devices and routed them through the QTRouter network.
The botnet used hard-coded domains qtproxy.xyz, qt-proxy.org, and qt-team.com for command-and-control.
QTFY exploited CVE-2019-11510 in Ivanti Pulse Secure VPN during a 2019 NASA intrusion attempt.
A separate attack leveraged CVE-2019-19781 in Citrix VPN products against a Missouri insurance agency.
Lumen’s Black Lotus Labs reported a 2023 resurgence of a Typhoon-linked botnet with 1,500 compromised devices.

1 of 2

DOJ Disrupts Chinese Hackers

U.S. Justice Department disrupted a Chinese state-sponsored hacking operation targeting federal agencies.
The DOJ seized and disabled the QScan and QTRouter domains used by the hackers.
QTFY, operated by Nanjing Xinjiuwei Network Technology, provided services to China’s Ministry of State Security and PLA.
The botnet targeted the DOJ, NASA, the Federal Reserve, Senate, Energy, HHS, NIH and DOE labs.

1 / 2