The Federal Bureau of Investigation has disrupted a China-linked hacking group known as QTFY that had compromised more than 300 organizations, including sensitive U.S. government networks, defense contractors, financial institutions and universities. The Justice Department announced Wednesday that it had seized three domains used by the group's primary platforms, QScan and QTRouter, effectively disabling their operations.
According to newly unsealed court records, QTFY operated through a China-based company that allegedly sold hacking services to entities including China's Ministry of State Security and the People's Liberation Army. Former members of the PLA reportedly worked for the company, leveraging military connections for offensive cyber operations. The group employed a method of mass internet scanning combined with a network of compromised devices, such as routers and cameras, to disguise the origin of their attacks. This technique allowed malicious traffic to blend with legitimate local network activity, making it more difficult to trace.
The FBI affidavit indicated that on a single day in 2024, the QScan platform performed over 2 million scanning and penetration-testing tasks. It contained more than 200 pre-built exploits designed to find vulnerable software, exposed services, and other entry points for exploitation.
Federal authorities stated that QTFY's targets included agencies such as NASA, the Justice Department, the Federal Reserve, and Senate systems. The group also targeted power companies, hospitals, telecommunications providers, defense contractors, and election infrastructure. While not all attempts were successful—a 2019 effort to breach NASA was thwarted because the agency had already patched the exploited vulnerability—many attacks succeeded.
In May 2024, QTFY exploited a recently disclosed vulnerability in Check Point software while scanning U.S. power and telecommunications companies. This led to the theft of data from over 300 organizations, both within the United States and internationally. The specific organizations and the nature of the stolen information have not been disclosed, but victims included U.S. defense contractors, financial institutions, and universities.
Later, in September 2024, the hackers exploited zero-day flaws in Ivanti Cloud Services Appliance software. This allowed them access to three Department of Energy national laboratories, the National Institutes of Health, the Health Resources and Services Administration, and a U.S. security-device manufacturer. The extent of data accessed and whether operations were disrupted remain unknown.
"State-sponsored malicious hackers preying on America’s critical infrastructure will be stopped and prosecuted," Attorney General Todd Blanche said in a statement. The seizure of QTFY's domains follows a series of similar operations by the FBI aimed at dismantling infrastructure used by Chinese government-linked hacking groups. Previous disruptions include actions against the Volt Typhoon botnet in 2023, a botnet supplied by Flax Typhoon in 2024, and the removal of PlugX surveillance malware from thousands of U.S. computers infected by Mustang Panda last year.