The FBI has disrupted online infrastructure associated with a group accused of supplying reconnaissance and traffic-obfuscation capabilities to China-linked cyber espionage operations targeting U.S. government agencies and other sensitive organizations.
According to the U.S. Department of Justice, the group is tracked as QTFY, QT, or QTCYBER and operated two platforms called QScan and QTRouter. Authorities say the infrastructure supported operations directed at U.S. critical infrastructure and other high-value networks.
Organizations targeted by QTFY reportedly included NASA, the Federal Reserve, the U.S. Senate, and the Departments of Energy, Justice, and Health and Human Services. The National Institutes of Health was also among the identified targets.
QTFY allegedly developed and maintained QScan and QTRouter while working for Nanjing Xinjiuwei Network Technology Company, a business based in China. Court records cited by the Justice Department state that members of the group include former personnel from the Chinese People’s Liberation Army. Investigators also identified payments from China’s Ministry of State Security to Nanjing Xinjiuwei, which authorities say indicate that the company conducted cyber operations on behalf of the Chinese government.
As part of the disruption, authorities seized three domains associated with the infrastructure: qtproxy.xyz, qt-proxy.org, and qt-team.com. The domains were allegedly used to operate QScan, described in court documents as a scanning and exploitation platform, and QTRouter, which provided capabilities for concealing network activity.
Research from Lumen Technologies’ Black Lotus Labs identified a broader system supporting the operation. QScan collected information about potential targets, including exposed ports, application banners, operating-system fingerprints, and configuration details.
Another component, known as Fast Labyrinth, provided an encrypted relay network for concealing communications between operators and targeted environments. QTRouter provided access to the proxy infrastructure through a preconfigured physical device, while QTProxy allowed operators to select relay nodes and build customized routes through the network.
The infrastructure was observed targeting organizations across numerous sensitive sectors, including military and defense, government, aerospace, healthcare, financial services, energy, universities, research institutions, bioinformatics, and enterprise software.
Black Lotus Labs also took action against infrastructure identified during its investigation by null-routing traffic associated with known operational points.
A central part of the system involved Operational Relay Box (ORB) techniques. Such networks allow operators to route activity through intermediary infrastructure, making it more difficult for defenders to identify where malicious traffic actually originates.
Rather than depending entirely on a conventional network of compromised devices, the QTFY operation reportedly purchased premium access to selected nodes belonging to the commercial proxy service fastlink.ws. Those nodes became part of the Fast Labyrinth network, allowing espionage-related traffic to blend with legitimate proxy traffic while its exit infrastructure changed dynamically.
Researchers found an important connection between organizations initially identified through QScan and systems that were subsequently contacted through Fast Labyrinth. Lumen assessed that observed bidirectional communications from the proxy infrastructure could represent activities including exploitation attempts, lateral movement, persistence, or information collection, although those individual activities were not confirmed in every observed connection.
The FBI’s seizure removes domains supporting the operation, while Lumen’s intervention disrupted additional identified infrastructure. However, researchers caution that conventional IP blocking has limitations against infrastructure built around dynamically rotating commercial proxy nodes, allowing the apparent origin of network traffic to change frequently.