Threat Intelligence Brief
Curated summary with source attribution
Source: tradingview.com
Threat Risk: High
Victim: US Federal Government agencies
Incident: Seizure of hacking platforms QScan and QTRouter used by threat group QTFY.
Impact: Potential compromise of sensitive data across multiple US government departments and the Senate.
Attacker: QTFY (linked to Nanjing Xinjiuwei Network Technology Co.)
Analysis: US law enforcement seized domains for QScan and QTRouter, tools operated by the threat actor QTFY. This group, linked to Nanjing Xinjiuwei Network Technology Co., reportedly provided hacking services to the MSS and PLA. The operation targeted high-value US entities, including NASA, the Federal Reserve, and the U.S. Senate.
Recommendations: Monitor network logs for indicators associated with QScan and QTRouter tools.; Review access logs for unauthorized activity within federal and energy sector systems.; Strengthen identity and access management to mitigate the risk of state-sponsored espionage.
Source: TradingView/Benzinga
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source
Latest Developments
Update — 2026-08-30 03:06 UTC
US authorities seized the infrastructure of a China-linked hacking network used for state-sponsored espionage. Obfuscation of attack origins enabled persistent targeting of critical government infrastructure since 2018. The threat group QTFY utilized a two-pronged system consisting of QScan and QTRouter to build a massive proxy network. By compromising consumer IoT devices, they successfully obfuscated the origin of attacks directed at critical US infrastructure and health agencies. This operation underscores the continued risk of state-sponsored espionage utilizing residential proxy networks to bypass perimeter defenses.
Corroborating source: medicaldaily.com