U.S. Seizes Domains of QScan and QTRouter Platforms Linked to QTFY

QTFY domain seizure was announced on August 26 by the U.S. Department of Justice (DOJ) and the FBI. Under court authorization, they took control of domains used by the QScan and QTRouter platforms, which the DOJ said were operated by the Chinese group QTFY. U.S. authorities said both platforms were thereby taken offline.

The case is significant mainly because it involved more than a single malicious server. According to a joint warning from the FBI, NSA and Cyber National Mission Force, the infrastructure covered multiple phases of cyber operations: QScan was used to identify and exploit vulnerabilities, while QTRouter provided an obfuscation network for further communications.

QTFY domain seizure hit both reconnaissance and proxy infrastructure

The U.S. warning describes QScan as a tool designed to automatically scan targets on the internet and attempt to exploit identified weaknesses. QTRouter, by contrast, was intended to help conceal the origin and routing of activity. It reportedly used compromised Internet of Things devices, commercial proxy services and virtual private servers.

This combination gives attackers the ability to first identify potentially vulnerable systems and then communicate through distributed infrastructure. For security teams, this makes it more difficult to distinguish malicious traffic from ordinary internet activity, especially when communications pass through legitimate cloud or proxy services.

The DOJ attributes QTFY to the Chinese company Nanjing Xinjiuwei Network Technology Company. According to the department, its customers included China’s Ministry of State Security (MSS) and the People’s Liberation Army (PLA). This is an attribution by U.S. authorities based on an investigation and court documents; complete independent public verification of all these findings is not available.

Listed targets include federal institutions and NASA

The DOJ listed NASA, the Federal Reserve, the Departments of Justice and Energy, the Department of Health and Human Services, the National Institutes of Health and the U.S. Senate among the victims of activity attributed to QTFY. However, the published materials do not state the extent of any access, the data stolen or the specific impact on the networks of individual organizations.

It is important to distinguish scanning from successful intrusion. The joint government warning states that QTFY scanned the U.S. Senate in March 2026, but that an attempt to gain access to the network was unsuccessful. It is therefore inaccurate to claim that the group breached all organizations named in the DOJ announcement.

Seizing QTFY’s domains may limit attackers’ ability to use established command-and-control and obfuscation channels. By itself, however, it does not mean that all related servers, devices or compromised IoT elements have been removed. Nor does it automatically clean networks that attackers may have accessed before the intervention.

What network administrators should check

The FBI, NSA and Cyber National Mission Force published indicators of compromise and recommended mitigation measures alongside the warning. Organizations should use this information for retrospective reviews of logs, network traffic and systems exposed to the internet.

• Update software and firmware, especially on internet-accessible devices.
• Review VPNs, IoT devices and remote-management interfaces that could provide an entry point.
• Separate critical systems from peripheral devices and limit unnecessary direct connections.
• Compare internal telemetry with the published indicators of compromise.

Going forward, it will be important to see whether the FBI or DOJ add court documents and clarify which organizations experienced successful access. It will also become clear whether QTFY rebuilds its infrastructure under new domains or changes its techniques and indicators.

Verified and updated: 08/27/2026 18:53