FBI Disrupts China-Linked QTFY Infrastructure Used to Steal Data From U.S. Organizations
FBI and Lumen disrupted QTFY's QScan and QTRouter botnet platforms used by Chinese state-sponsored hackers to conceal intrusions into U.S. agencies.
78
Victim
Federal Reserve
- Mentions · 7d0
- Mentions · 30d0
- All mentions6
- First seenAug 26, 2026
- Last mentionedSep 2, 2026
Timeline
6 articles · newest firstFBI takes down China-linked hacking network behind attacks on NASA, DOJ and U.S. Senate
FBI seized domains disabling QScan and QTRouter malware run by China-linked QTFY group behind intrusions at NASA, DOJ, Senate and other agencies.
80
Officials disrupt Chinese espionage operation that hit multiple federal agencies
FBI and DOJ seized QTFY infrastructure, disrupting a Chinese state-sponsored group that compromised federal agencies and critical infrastructure since 2018.
88
FBI Disrupts Chinese Proxy Tools Used in Mass Hacking of US Agencies and Infrastructure
FBI disrupted Chinese state-linked proxy infrastructure used in hacking campaigns against NASA, the Federal Reserve, the US Senate, and other US targets.
82
FBI Seizes China-Linked Hacking Platforms QScan and QTRouter Used Against Critical Infrastructure
FBI seizes China-linked QScan and QTRouter hacking platforms used by QTFY to obfuscate intrusions against US federal agencies.
78
US takes down alleged Chinese hacking tools used against Federal Reserve, DOJ and Senate
DOJ takes down QScan and QTRouter Chinese obfuscation platforms used to breach Federal Reserve, DOE, DOJ, and Senate since 2018.
76
Related CVEs
by mentions- CVE-2021-44228100%10.0JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell)
- CVE-2019-1006895%9.8Unauthenticated RCE in Kentico Xperience Staging Service
- CVE-2025-31161100%9.8Authentication Bypass in CrushFTP File Transfer Servers (CVE-2025-31161)
- CVE-2018-13379100%9.8Unauthenticated Path Traversal in Fortinet FortiOS SSL VPN
- CVE-2020-5902100%9.8Unauthenticated RCE via path traversal in F5 BIG-IP TMUI
- CVE-2024-896399%9.1Unauthenticated Path Traversal in Ivanti Cloud Services Appliance
- CVE-2021-26855100%9.1Unauthenticated SSRF/RCE in Microsoft Exchange Server (ProxyLogon)
- CVE-2024-24919100%8.6Information Disclosure in Internet-Facing Check Point Quantum Security Gateways
- CVE-2024-938058%7.2OS Command Injection RCE in Ivanti Cloud Services Appliance Admin Console
- CVE-2024-819089%7.2OS Command Injection RCE in Ivanti Cloud Services Appliance 4.6
Appears with
- FBIorganization · 6
- NASAvictim · 6
- Department of Energyvictim · 5
- Department of Justicevictim · 5
- NIHvictim · 5
- QTFYthreat actor · 5
- DOJorganization · 3
- Microsoftvendor · 3
- Ministry of State Securityorganization · 3
- BeyondTrustvendor · 3
- Check Pointvendor · 3
- F5vendor · 3
- Fortinetvendor · 3
- US Senatevictim · 3
- Citrixvendor · 3
- Pulse Securevendor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.