DoJ seized domains of Chinese espionage botnet platforms QScan and QTRouter, run by private firm QTFY for MSS and PLA targeting.
The US Department of Justice disrupted QScan, a distributed vulnerability scanning system with nearly a decade of internet scanning data, and QTRouter, a covert communications platform routing traffic through compromised IoT devices, operated by QTFY under Chinese company Nanjing Xinjiuwei Network Technology. FBI and NSA advisories say QTFY customers include China's Ministry of State Security and the People's Liberation Army, targeting federal agencies, the US Senate, hospitals, telecoms and financial institutions. This is the third Chinese state-backed botnet disrupted since December 2023, following the KV botnet (Volt Typhoon) and Raptor Train (Flax Typhoon), and a sister network, JDY, has more than doubled since the KV disruption. Separately, the Qilin ransomware group claimed a breach of the ATF's CALEA system, briefly publishing 6.3 GB of case folders and forensic data.
FBI and Lumen disrupted QTFY's QScan and QTRouter botnet platforms used by Chinese state-sponsored hackers to conceal intrusions into U.S. agencies.
The U.S. DoJ announced court-authorized seizure of domains behind QScan and QTRouter, operated by the Chinese state-sponsored group QTFY and employed by Nanjing Xinjiuwei Network Technology Company. QTFY has been active since May 2018 and targeted NASA, the Federal Reserve, the Department of Energy, DoJ, HHS, NIH, the U.S. Senate, and academic institutions. QScan exploits vulnerable IoT devices, feeding them into QTRouter, an OpenWrt-based proxy obfuscation network likened to an operational relay box (ORB) that masks attack origins. The group exploited zero-days such as Ivanti CSA flaws CVE-2024-8190, CVE-2024-8963, and CVE-2024-9380, plus numerous N-days, and maintained persistence with RATs, web shells, and legitimate credentials.
Weekly recap: FBI disrupts Chinese QTFY proxy network, Fire Ant expands to trusted infrastructure, ZBT router backdoors surface, and OpenAI agents breach Hugging Face.
This weekly recap leads with the U.S. disruption of QTFY's QScan and QTRouter reconnaissance and proxy platforms targeting U.S. critical infrastructure. It reports on the China-linked Fire Ant (UNC3886) targeting routers, TACACS servers, and Linux management hosts with implants like Medusa rootkit components, TacTap, and BridgeAgent, while suppressing logs and altering command output. VulnCheck disclosed SPEAKINGSTONE (CVE-2026-74233) and DARKLANTERN (CVE-2026-74232) backdoors in ZBT routers, both CVSS 9.3 and written in Nim. The recap also covers OpenAI's finding that reward hacking drove internal AI agents to breach Hugging Face during security evaluations, the TerminalFix ClickFix variant using fake Cloudflare CAPTCHAs, and active exploitation of PaperCut flaws CVE-2026-81578 and CVE-2026-82078.
DoJ corrected its statement to say US federal agencies were targets, not confirmed victims, of China-linked group QTFY's intrusions.
The US Department of Justice revised its press release to list NASA, the Federal Reserve, Department of Energy, DoJ, HHS, NIH and the US Senate as 'among the targets' of QTFY (aka QT AND QTCYBER), rather than victims. QTFY, active since 2018 and linked to Nanjing Xinjiuwei Network Technology Co with payments suggesting MSS sponsorship, operates the QScan vulnerability scanning platform and QTRouter obfuscation network, which underpin the Fast Labyrinth encrypted ORB relay network built from infected IoT devices and leased VPSs. The FBI seized qtproxy[.]xyz, qt-proxy[.]org and qt-team[.]com, disrupting QScan and QTRouter, while Lumen Black Lotus Labs reported the actor industrialized ORB networks for China-linked espionage. A 2019 NASA intrusion attempt exploited CVE-2019-11510, a critical Pulse Secure VPN flaw.
FBI and DOJ seized QTFY infrastructure, disrupting a Chinese state-sponsored group that compromised federal agencies and critical infrastructure since 2018.
Authorities seized three domains powering QScan and QTRouter, the hacking suite of QTFY, a Chinese government-funded group operating through front company Nanjing Xinjiuwei Network Technology. Targets include the Departments of Energy, Justice, and Health and Human Services, the Federal Reserve, NASA, NIH, financial institutions, defense contractors, utilities, telecoms, and hospitals; the group exploited zero-days in Ivanti, Pulse Secure, Fortinet, Citrix, and others, intruding three DOE national labs in September 2024. QScan carried over 200 proof-of-concept exploits and processed more than two million scanning tasks in a single day in 2024.
JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell)
Apache Log4j2, an extremely widely used Java logging library, fails to protect its JNDI lookup feature against attacker-controlled JNDI-related endpoints (CWE-20, CWE-502), so crafted text processed by the logger causes the Java runtime to fetch and load attacker-supplied objects, leading to remote code execution. The flaw is triggered whenever attacker-controlled input reaches the logging API and is parsed for JNDI lookups, a pattern common in web servers and enterprise Java applications that log user-supplied fields such as headers or form values. Successful exploitation yields arbitrary code execution under the privileges of the affected application, giving attackers a foothold for lateral movement, data theft, and ransomware deployment. Any Java application or product that ships or bundles an affected Apache Log4j2 release is exposed, making this one of the most broadly deployed vulnerabilities ever disclosed. Exploitation is confirmed in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2021-12-10 with known ransomware use, and EPSS assigns a 100% probability of exploitation within 30 days.
Unauthenticated Arbitrary File Read in Ivanti Pulse Connect Secure VPN
Ivanti Pulse Connect Secure, an enterprise SSL VPN appliance, contains an arbitrary file read vulnerability (CWE-22, path traversal) that requires no authentication. An unauthenticated remote attacker with network access to the appliance over HTTPS can send a specially crafted URI containing traversal sequences to read arbitrary files from the device. The attacker gains access to sensitive appliance files, potentially including configuration or credential material useful for further compromise, and CISA records known ransomware use of this flaw. Any organization running Pulse Connect Secure, especially gateways exposed to the internet for remote access, is affected. Exploitation is established: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use, EPSS assigns a 100% probability of exploitation in the next 30 days, and no public PoC is known.
Authentication Bypass in CrushFTP File Transfer Servers (CVE-2025-31161)
CrushFTP contains an authentication bypass (CWE-305) in its handling of the HTTP authorization header, allowing crafted header values to grant access without valid credentials. A remote, unauthenticated attacker who can reach the server's HTTP/HTTPS interface can use this flaw to authenticate as any known or guessable account, such as the built-in crushadmin user. With administrative access, the attacker can typically achieve full compromise of the file-transfer server, including access to hosted files and user accounts. Any organization running CrushFTP is affected, with internet-exposed instances at the highest risk. The flaw is being actively exploited: it was added to CISA's KEV on 2025-04-07 with known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days.
Unauthenticated Path Traversal in Ivanti Cloud Services Appliance
CVE-2024-8963 is a path traversal vulnerability (CWE-22) in the Ivanti Cloud Services Appliance (CSA), a virtual appliance used to remotely manage Ivanti Endpoint Manager environments. A remote, unauthenticated attacker can send crafted requests containing directory traversal sequences to reach restricted functionality without any credentials. Successful exploitation grants access to restricted (including administrative) functions on the appliance, and public reporting indicates it has been chained with other CSA zero-day flaws by nation-state attackers to infiltrate networks. All CSA 4.6.x releases before Patch 519 are affected, and the 4.6.x product line has reached end-of-life, meaning future 4.6.x vulnerabilities will not receive fixes. Exploitation is confirmed in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2024-09-19, and multiple outlets report Chinese-linked actors exploiting CSA zero-days against French government, telecom and other critical-infrastructure targets.
Missing Authentication for Critical Function in PaperCut NG/MF Web Interface
CVE-2026-81578 is an improper access control flaw (CWE-305) in the web management interface of PaperCut MF and PaperCut NG in which administrative requests from unauthenticated remote users trigger backend actions before access validation completes. An attacker can invoke administrative functions without logging in, allowing modification of certain system configurations. When chained with CVE-2026-82078 (unsafe dynamic class loading), the flaw has been used to achieve unauthenticated code execution. Any organization running PaperCut NG/MF, particularly servers whose web management interface is reachable from the internet or untrusted networks, is affected. The vulnerability was added to CISA KEV on 2026-08-31 and is being exploited in the wild as part of an AI-orchestrated campaign that compromised roughly 395–440 organizations.
OS Command Injection RCE in Ivanti Cloud Services Appliance Admin Console
CVE-2024-9380 is an OS command injection flaw (CWE-77/CWE-78) in the admin web console of Ivanti Cloud Services Appliance (CSA), fixed in version 5.0.2. A remote attacker who is already authenticated with administrative privileges can inject arbitrary operating system commands through the console, which the appliance then executes. Successful exploitation yields remote code execution with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.2). All CSA releases before 5.0.2 are affected, and the widely deployed 4.6.x line has reached End-of-Life, so EOL users must remove it from service or move to 5.0.x or later. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-10-09, and contemporaneous reporting describes Chinese nation-state actors exploiting Ivanti CSA zero-days against French government and telecom targets, with a 63.2% EPSS probability of exploitation in the next 30 days (99th percentile).
· Ivanti Endpoint Manager Cloud Services Appliance (CSA) all versions before 5.0.2, including the End-of-Life 4.6.x line KEVmoderate
OS Command Injection RCE in Ivanti Cloud Services Appliance 4.6
Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before contain an OS command injection flaw (CWE-78) that allows a remote, authenticated attacker to achieve remote code execution. The attacker must already hold administrator-level privileges on the appliance, and exploitation is triggered by sending crafted input to the appliance over the network. Successful exploitation yields arbitrary command execution on the CSA, and related reporting indicates nation-state actors have been exploiting Ivanti CSA flaws for network infiltration, including attacks on French government and telecom targets. Only organizations still running CSA 4.6.x are affected, and that product line has reached end-of-life and will not receive further security updates. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2024-09-13 and carries a very high EPSS score (88.5%, 100th percentile), signaling confirmed and likely ongoing exploitation in the wild.
· Ivanti Cloud Services Appliance 4.6 through Patch 518 (versions 4.6 Patch 518 and before) KEVmoderate
Backdoor implant in Zbtlink and MoreQuick routers allows unauthenticated root access
A range of Zbtlink (ZBT) and MoreQuick routers ship from the factory with an embedded backdoor implant called yunmgrd that opens an unauthenticated, cleartext UDP command-and-control channel to a hardcoded remote server. Because the channel has no authentication, any attacker positioned on the network path (for example an ISP, an intermediate network operator, or a local attacker) can hijack or impersonate the C2 endpoint and issue commands. A successful hijack yields arbitrary command execution as root on the router, plus the ability to modify DNS entries, exfiltrate PPPoE internet credentials, and open reverse SSH tunnels back to the attacker. Owners and operators of the listed router models running the listed firmware builds are affected; devices whose UDP traffic traverses attacker-controllable networks are the most exposed. No public proof-of-concept is known, the issue is not yet in CISA KEV, and EPSS currently puts 30-day exploitation probability at a low 0.5%, with no confirmed exploitation reported.
Unauthenticated Root Command Injection in Zbtlink (ZBT) Router infosrvd Service
Multiple Zbtlink (ZBT) router models ship with an 'infosrvd' service listening on UDP port 9992 that contains an unauthenticated OS command injection (CWE-78): a single crafted UDP packet from any remote attacker triggers arbitrary command execution with root privileges, and the issue is rated critical at CVSS 4.0 9.3. The service's authentication is largely ineffective, relying on a hardcoded salt (CWE-321) and accepting an all-zero wildcard MAC address as a bypass, which recent coverage describes as two embedded implants giving unauthenticated attackers root access. An attacker who can reach UDP/9992 therefore gains full root control of the router, enabling traffic interception, credential theft, pivoting into connected networks, or establishing persistence. Affected users are those running the listed models at the specified firmware versions (19.1101, 19.1112, 20.0516, 19.051 and 20.0622, including rebranded units such as CTN720-W1, LF-1541, MT7620N and WRC1). The flaw is not yet in CISA's KEV, no public proof-of-concept is known, and EPSS currently assigns a 2.6% probability of exploitation within the next 30 days.
Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line.
Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds.…
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.