A sophisticated Chinese hacking group known as QTFY is actively targeting US government and critical infrastructure systems via an ecosystem of custom-built malicious platforms, the FBI has warned.

The group has focused on critical infrastructure sectors including defense industrial base (DIB), communications, government and higher education for close to a decade since being established in 2018.

In 2024, QTFY successfully exfiltrated data from over 300 organizations in the US and globally after leveraging an exploit for a Check Point Quantum Gateway vulnerability. Victims included US defense contractors, financial institutions and universities.

Other entities that have been targeted by the group include the US Department of Justice, US Federal Reserve, and NASA, while attempts have been made to compromise hospitals and election systems in the country.

Custom Platforms Used to Power QTFY Attacks

QTFY has developed its own distributed ecosystem that allows it to conduct these malicious operations efficiently, while making it difficult for defenders to identify and track the activity.

This includes a platform named “QScan,” which is designed to rapidly identify vulnerabilities in victim networks and exploit vulnerable IoT devices.

This scanning tool is extremely powerful, with the FBI revealing QTFY used it to conduct over two million scanning and penetration testing tasks in a single day in 2024.

QTFY also has developed a product called “QTRouter,” a network traffic obfuscation network running on devices that include routers with custom OpenWrt software.

Additionally, it uses botnet products to control the compromised IoT devices and include them as QTRouter proxy nodes.

“These products work in conjunction with each other,” the FBI noted.

US government and critical infrastructure entities have been advised to take urgent action to mitigate the threat from QTFY.

The FBI noted that QTFY, who also use the acronyms QT and QTCYBER, has been attributed to Nanjing Xinjiuwei Network Technology Co. This is an enabling company for cyber operations linked to the People’s Republic of China (PRC).

While the advisory did not disclose the aims of the attackers, it is likely that espionage is a key motivation.

Nick Tausek, lead security automation architect at Swimlane, said: “Military and defense-linked networks are about as sensitive as targets get. They can expose operational plans, contractor relationships, technical capabilities and access paths into systems tied directly to national security. Even limited access can give an adversary intelligence that’s useful far beyond the organization initially breached.”

Read now: Google Cloud: China Achieves “Cyber Superpower” Status

How QTFY Identifies Victims and Launches Attacks

The FBI advisory, published in coordination with the National Security Agency and Cyber National Mission Force on August 26, highlighted QTFY’s focus on exploiting zero-day and N-day vulnerabilities to gain initial access to victim networks.

The QScan platform conducts reconnaissance against victim networks, including webpage scraping, TLS certificate collection, subdomain enumeration and penetration testing.

It maintains a large database to quickly identify targets of interest when a new vulnerability is identified.

The threat actors also participate in a range of freelance PRC hacker networks and malicious cyber contracting and subcontracting marketplaces. This enables them to keep up with new exploits and attack techniques, including the integration of AI into their processes.

Once inside a network, QTFY attempts to maintain persistence through a variety of techniques, from deploying remote access trojans (RAT) and web shells to obtaining legitimate credentials.

The QTRouter obfuscation network enables the group to access victim networks from nearby compromised IoT devices, blending in with legitimate users.

The FBI revealed that unique user agent strings originating from IP addresses in China indicated that QTRouter was used by QTFY personnel and PRC government personnel.

QTFY has also developed and maintained at least three major platforms that can manage botnets of compromised IoT devices as part of this obfuscation network.

Commenting on the advisory, Gabrielle Hempel, security operations strategist at Exabeam, said that the scale and sophistication of QTFY’s model pose unique challenges to defenders.

“They have built an ecosystem designed to make malicious activity look geographically and operationally ordinary,” she said.

Hempel noted that the group’s vulnerability scanning tool gives it a head start when a new vulnerability emerges.

“It does not necessarily need to search for targets from scratch; it may already have a catalogue of exposed systems ready to match against the latest exploit,” she added.

How to Defend Against QTFY Activity

The authoring agencies recommended that government and critical infrastructure organizations take a range of measures to protect against QTFY’s malicious activity. These include:

• Apply the latest software and firmware updates to your organization's devices
• Regularly audit your organization's web pages and applications for published secrets, such as API keys and tokens
• Proactively threat hunt for indicators of compromise included in the advisory
• Isolate critical systems from edge devices
• Regularly test your organization’s security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework detailed in the advisory

US Authorities Disrupt QTFY Infrastructure

In a separate announcement on August 26, the US Justice Department and FBI revealed they had successfully disrupted the QScan and QTRouter platforms used by QTFY, denying malicious cyber actors access to the tools.

According to court documents, QTFY offers hacking services including QScan and QTRouter to paying customers.

The law enforcement action is the latest in a series of court-authorized technical operations against indiscriminate hacking activities by the PRC, the Justice Department said.