QTFY

Aug 28 – September 1, 2026

• ZeroTrace published a deep dive on how the Chinese state-linked QTFY botnet was organised and run, including espionage traffic routed through a paid commercial proxy subscription (Catalin Cimpanu) (earlier coverage). Flare separately documented how its researchers de-anonymised the TeamPCP members arrested in Australia last week (Catalin Cimpanu). · Sep 1 · none · as teampcp · Threat Activity

Aug 27 – August 28, 2026 · 2 reports

• NSA, FBI and Cyber National Mission Force issued a joint advisory on QTFY, the China-linked group active since 2018 whose QScan and QTRouter platforms were seized this week (earlier coverage). US authorities tie the group to Nanjing Xinjiuwei Network Technology (XJW) as an enabling contractor, with targeting across the Defense Industrial Base, telecoms, local government and higher education (NSA, The Hacker News). · Aug 28 · observed · Threat Activity
• DOJ and the FBI seized the domains behind QScan and QTRouter, two complementary platforms used to scan, infect and exploit IoT and edge devices as staging for intrusions into US federal agencies and critical infrastructure — reported victims include NASA, DOE, the Senate, the Federal Reserve and DOJ itself. The activity is attributed to Chinese state-sponsored group QTFY, tied to Nanjing Xinjiuwei Network Technology (DOJ, The Record). BleepingComputer frames the target as a technical "quartermaster" supplying recon, proxy management and operational routing to multiple espionage crews (discussion). · Aug 27 · observed · via edge device · Threat Activity