China-Linked Group QTFY Targets Global Critical Infrastructure

The FBI, NSA, and CNMF have issued a joint advisory regarding QTFY (also known as QT or QTCYBER), a China-linked threat actor group active since 2018. The group is attributed to Nanjing Xinjiuwei Network Technology Co. (XJW) and maintains business relationships with PRC Ministry of State Security (MSS) units and other state-sponsored actors like Salt Typhoon. QTFY operates as an enabler within the PRC ecosystem, developing specialized tools and managing large-scale obfuscation networks comprised of compromised IoT devices.

The group's primary technical advantage stems from three distributed platforms: QScan for large-scale vulnerability scanning, QTRouter for network traffic obfuscation using custom OpenWrt software and Clash proxies, and several botnet management systems (Proxy Platform Management, Proxy Pool Management System, and QTBotnet). These tools allow the group to blend malicious activity with legitimate traffic by utilizing the geographic locations of compromised IoT nodes worldwide. QTFY is highly proficient in exploiting zero-day and N-day vulnerabilities, including recent flaws in Ivanti, Check Point, and BeyondTrust products.

QTFY’s activity poses a direct threat to the Defense Industrial Base (DIB), telecommunications, energy, and government sectors. The group has demonstrated the ability to exfiltrate data from hundreds of organizations simultaneously and maintains persistence through Remote Access Trojans (RATs) and compromised credentials. Their integration of AI into operational workflows and active participation in PRC hacking marketplaces indicate a rapidly evolving and sophisticated threat profile that requires immediate defensive attention.