QTFYThreat actor
QTFY is a state-sponsored group from the People's Republic of China, operating as an infrastructure quartermaster that provides reconnaissance, access, and obfuscation services to various state customers, including the MSS and PLA. It developed QScan and QTRouter, leveraging high-tier commercial proxy services like fastlink[.]ws to obscure its traffic.From MISP Galaxy
Last reported 27 days ago, by CERT-EU7 reports
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1684Social Engineering
“Spring Ring campaign: A hacking group has targeted more than 150 employees across at least 10 companies as part of a coordinated social engineering campaign.”
- T1505.003Web Shell
“…nside a network, QTFY attempts to maintain persistence through a variety of techniques, from deploying remote access trojans (RAT) and web shells to obtaining legitimate credentials.”
- T1014Rootkit
“…able Roundcube servers to relay C2 traffic and also exploited CVE-2026-68820, a zero-day vulnerability in Windows to deploy a FudModule rootkit.”
- T1027.017SVG Smuggling
“SVG smuggling campaign: Kaseya's INKY team has spotted a massive email spam campaign using SVG smuggling to assemble a phishing page right in the user's browser.”
- T1110.003Password Spraying
“AWS password spraying campaign: A password spraying campaign has targeted the root user accounts of AWS tenants.”
- T1195Supply Chain Compromise
“In regards to cybercrime, we noted a Rust crates supply-chain compromise via typosquatted dependency, with infrastructure overlapping with operations attributed to North Korea-linked threat actors.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
7 reports, newest first · the exact sentence from each-
Cyber Brief 26-09 - August 2026“On August 26, the US Justice Department and FBI announced the seizure of domains used by QTFY, a China state-sponsored hacking group, to disrupt QScan and QTRouter.”
-
August 2026 Dark Web Threat Actor Trend Report“…inance government Hacktivism IAB Iran 이란 일본 중국 영국 호주 싱가포르 Japan law-enforcement LockBitSupp Manufacturing NoName05716 norway Panzer QScan QTFY RaaS Ransom-Cartel Retail rootor seizure Sentencing Singapore Social-Engineering Storm supply-chain-attack T1ER0NE TeamPCP transportation…”
-
Srsly Risky Biz: China's Private Sector Botnets Are Worth Disrupting“An FBI affidavit says the group running the platforms, QTFY, works for the private Chinese company Nanjing Xinjiuwei Network Technology.”
-
Risky Bulletin: BGP hijack targets Virtualizor to deliver malicious updates“QTFY botnet: Last week, the DOJ seized a botnet used by Chinese state-sponsored hackers to attack US organizations.”
-
31st August – Threat Intelligence Report“authorities announced the disruption of QScan and QTRouter, two platforms operated by China-linked group QTFY to target U.S.”
-
Risky Bulletin: Two TeamPCP members arrested in Australia“The DOJ says the two botnets were part of a commercial hacking platform named QTFY that was rented to Chinese state groups.”
-
Chinese Hacker Group QTFY Uses Custom-Built Platforms to Target US Infrastructure, FBI Warns“Chinese Hacker Group QTFY Uses Custom-Built Platforms to Target US Infrastructure, FBI Warns”
Indicators in its reports
named in the reports above- infosec[.]exchangein 2 reports
- zet[.]netin 1 report
- www.virtualizor[.]comin 1 report
- eldomador.bsky[.]socialin 1 report
- hxxps://www.techdirt[.]com/2026/08/26/meta-just-paid-nearly-17-billion-to-make-sure-it-gets-to-write-the-kid-safety-rules-for-every-other-social-media-platform/in 1 report
- www.techdirt[.]comin 1 report
- techdirt[.]comin 1 report
- martinmatishak.bsky[.]socialin 1 report
- esetresearch.bsky[.]socialin 1 report
Copy these 9 indicators · defanged
Thanks — we review every report.