- The FBI and the National Security Agency led the issuance of a joint advisory about hacker group QTFY
- The FBI also collaborated with the Department of Justice to seize two of QTFY’s hacking tools
- The agencies are urging organizations to review their networks against the threat indicators found in their investigation
The National Security Agency announced Wednesday that it has partnered with the FBI and the Cyber National Mission Force to issue a joint cybersecurity advisory warning organizations about a China-linked hacking group known by the aliases QTFY, QT and QTCYBER.
On the same day, the Department of Justice also revealed that it worked with the FBI to enforce court-authorized seizures of domains tied to two interconnected hacking tools, “QScan” and “QTRouter,” identified in court filings as platforms owned by QTFY.
Save the date: senior intelligence community leaders and top government contractors will gather at the 2026 Intel Summit on September 24 to explore how AI, cyber and secure data-sharing are reshaping the intelligence mission. With keynote speakers from the FBI, NSA, DHS, NRO and the Joint Chiefs of Staff, secure your chance to gain firsthand insight into intelligence community priorities and build valuable connections with mission-critical industry partners. Sign up now!
What Are the Details of the FBI-Led Cybersecurity Advisory?
The advisory outlines how the QTFY threat group built a set of malicious distributed platforms capable of compromising networks belonging to both U.S. and international organizations, and it urges affected sectors to take immediate protective action.
To break into victim networks, QTFY operators rely on both zero-day flaws and unpatched vulnerabilities. Once inside, they harvest valid credentials from compromised machines to maintain long-term access. The advisory also notes that the group maintains ties to the broader exploit development community, participating in freelance hacking circles as well as marketplaces where malicious cyber contracting and subcontracting take place.
What Are the Agencies’ Recommended Actions?
The authoring agencies are urging organizations across all targeted sectors to strengthen their defenses against QTFY activity by taking the following steps:
- Keep devices current with the latest software and firmware patches
- Conduct regular reviews of public-facing webpages and applications to prevent sensitive operational details from being exposed
- Separate critical systems from edge devices to limit lateral movement
- Review networks against the indicators of compromise included in the advisory
The DOW on Aug. 26 published its own full joint cybersecurity advisory: “China-Linked Hacking Group QTFY Targets Military and Critical Infrastructure with Malicious Distributed Systems.”
What Prompted the DOJ and FBI’s to Confiscate QTFY Tools?
In a separate operation, the DOJ said that in collaboration with the FBI, it seized the QScan and QTRouter hacking tools owned by QTFY to cut off access for malicious cyber actors who used the platforms to target U.S. critical infrastructure and other high-value networks.
According to court documents, QTFY sold its hacking capabilities to paying clients, reportedly including the Chinese Ministry of State Security and the People’s Liberation Army. Its two flagship tools functioned in tandem: QScan searched for and compromised vulnerable internet of things devices on a mass scale, while QTRouter absorbed those compromised devices—along with commercial proxy services and leased virtual private servers—into a broader obfuscation network.
That network allowed QTFY and other malicious actors to mask the Chinese origin of their intrusions, making traffic appear to come from machines outside China, sometimes even from within the targeted network itself. Investigators were able to render both platforms inoperable because the seized domains were embedded directly into the QScan and QTRouter malware, supporting core functions such as communications and authentication.
The investigation and disruption effort were led by the FBI’s San Diego Field Office and Cyber Division, the U.S. Attorney’s Office for the Southern District of California and the National Security Cyber Section within the Justice Department’s National Security Division.
