[qtfy]

September 1, 2026

• ZeroTrace published a deep dive on how the Chinese state-linked QTFY botnet was organised and run, including espionage traffic routed through a paid commercial proxy subscription (Catalin Cimpanu) (earlier coverage). Flare separately documented how its researchers de-anonymised the TeamPCP members arrested in Australia last week (Catalin Cimpanu). · Threat Activity

in Attackers Are Living in the Management Plane

August 28, 2026

• NSA, FBI and Cyber National Mission Force issued a joint advisory on QTFY, the China-linked group active since 2018 whose QScan and QTRouter platforms were seized this week (earlier coverage). US authorities tie the group to Nanjing Xinjiuwei Network Technology (XJW) as an enabling contractor, with targeting across the Defense Industrial Base, telecoms, local government and higher education (NSA, The Hacker News). · Threat Activity

in Australia Charges Two Over the TeamPCP Supply-Chain Spree

August 27, 2026

• DOJ and the FBI seized the domains behind QScan and QTRouter, two complementary platforms used to scan, infect and exploit IoT and edge devices as staging for intrusions into US federal agencies and critical infrastructure — reported victims include NASA, DOE, the Senate, the Federal Reserve and DOJ itself. The activity is attributed to Chinese state-sponsored group QTFY, tied to Nanjing Xinjiuwei Network Technology (DOJ, The Record). BleepingComputer frames the target as a technical "quartermaster" supplying recon, proxy management and operational routing to multiple espionage crews (discussion). · Threat Activity

in When the Sandbox Isn't a Boundary