QTRouter

Mentions · 7d0
Mentions · 30d0
All mentions5
First seenAug 26, 2026
Last mentionedSep 3, 2026

Timeline

5 articles · newest first

Srsly Risky Biz: China's Private Sector Botnets Are Worth Disrupting

DoJ seized domains of Chinese espionage botnet platforms QScan and QTRouter, run by private firm QTFY for MSS and PLA targeting.

Risky Business NewsSep 3, 04:29 UTC · Sep 3, 2026Threat actor5

FBI Disrupts China-Linked QTFY Infrastructure Used to Steal Data From U.S. Organizations

FBI and Lumen disrupted QTFY's QScan and QTRouter botnet platforms used by Chinese state-sponsored hackers to conceal intrusions into U.S. agencies.

The Hacker NewsSep 2, 06:26 UTC · Sep 2, 2026Threat actorExploitedCVE-2018-13379 CVE-2019-10068 CVE-2019-19781+106 · 1 read

⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off

Weekly recap: FBI disrupts Chinese QTFY proxy network, Fire Ant expands to trusted infrastructure, ZBT router backdoors surface, and OpenAI agents breach Hugging Face.

The Hacker NewsSep 1, 16:45 UTC · Sep 1, 2026Threat actorExploitedCVE-2026-81578 CVE-2026-82078 CVE-2026-74232+24 · 1 read

DoJ Corrects China Hacking Claim, Says U.S. Agencies Were Targets, Not Victims

DoJ corrected its statement to say US federal agencies were targets, not confirmed victims, of China-linked group QTFY's intrusions.

The Hacker NewsAug 31, 07:56 UTC · Aug 31, 2026Threat actorExploitedCVE-2019-115108 · 2 reads

Officials disrupt Chinese espionage operation that hit multiple federal agencies

FBI and DOJ seized QTFY infrastructure, disrupting a Chinese state-sponsored group that compromised federal agencies and critical infrastructure since 2018.

CyberScoopAug 26, 19:35 UTC · Aug 26, 2026Threat actorExploited3 · 1 read

Related CVEs

by mentions

CVE-2021-44228100%10.0
JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell)
published Dec 10, 2021Apache Log4j2KEVRansomwarePoC ×9
CVE-2019-11510100%10.0
Unauthenticated Arbitrary File Read in Ivanti Pulse Connect Secure VPN
published May 8, 2019Ivanti Pulse Connect SecureKEVRansomwarePoC ×2
CVE-2025-31161100%9.8
Authentication Bypass in CrushFTP File Transfer Servers (CVE-2025-31161)
published Apr 3, 2025CrushFTPKEVRansomwarePoC ×5
CVE-2024-896399%9.1
Unauthenticated Path Traversal in Ivanti Cloud Services Appliance
published Sep 19, 2024Ivanti Cloud Services Appliance (CSA)KEV
CVE-2026-8157884%8.8
Missing Authentication for Critical Function in PaperCut NG/MF Web Interface
published Aug 28, 2026PaperCut MFKEV
CVE-2024-938058%7.2
OS Command Injection RCE in Ivanti Cloud Services Appliance Admin Console
published Oct 8, 2024Ivanti Endpoint Manager Cloud Services Appliance (CSA)KEV
CVE-2024-819089%7.2
OS Command Injection RCE in Ivanti Cloud Services Appliance 4.6
published Sep 10, 2024Ivanti Cloud Services ApplianceKEV
CVE-2026-74232<1%9.3
Backdoor implant in Zbtlink and MoreQuick routers allows unauthenticated root access
published Aug 27, 2026Zbtlink L3_V2_8
CVE-2026-742333%9.3
Unauthenticated Root Command Injection in Zbtlink (ZBT) Router infosrvd Service
published Aug 27, 2026Zbtlink WE1326
CVE-2026-66747<1%9.3
Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line
published Aug 5, 2026

Appears with

QScanproduct · 5
FBIorganization · 5
QTFYthreat actor · 4
Microsoftvendor · 3
NASAvictim · 3
Ministry of State Securityorganization · 3
F5vendor · 2
Citrixvendor · 2
NSAorganization · 2
Department of Energyvictim · 2
Pulse Securevendor · 2
Check Pointvendor · 2
Fortinetvendor · 2
Black Lotus Labsorganization · 2
Lumenvendor · 2
Federal Reservevictim · 2

Entities are extracted by the model from each article. First seen Aug 26, 2026, last mentioned Sep 3, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.