FBI Dismantles Chinese Proxy Network Behind Widespread US Government Breaches
The Department of Justice announced the seizure of two tools, QTRouter and QScan, used by a Chinese state-sponsored hacking group to relay attacks through compromised IoT devices and commercial proxies. The operation disrupted a network that had breached multiple US federal agencies, including NASA and the Federal Reserve, and targeted critical infrastructure such as power and telecom companies. The FBI collaborated with Lumen's Black Lotus Labs on the takedown.
The QTFY group's infrastructure relied on two complementary tools: QScan identified vulnerable IoT devices to build botnets, while QTRouter managed access to those botnets alongside rented commercial proxy servers. The FBI's affidavit details that the operation disrupted domain infrastructure these tools depended on, with Lumen's Black Lotus Labs providing technical assistance throughout the takedown.
According to the DOJ, the hacking campaign extended back to at least 2018, with the proxy network serving as a relay system for Chinese state-sponsored attackers. The FBI affidavit lists targeted sectors including power companies, telecommunications providers, hospitals, financial institutions, and defense contractors, though it does not specify which were successfully breached or the extent of any intrusions.
This takedown could have significant ripple effects for both government and private sector cybersecurity. Organizations that relied on detecting and blocking known proxy infrastructure may need to reassess their defenses, while the disruption could temporarily slow Chinese state-sponsored operations. The case may also influence how private companies cooperate with federal law enforcement on cyber threats, potentially reshaping information-sharing practices between the public and private sectors.