The U.S. Department of Justice, in coordination with the FBI, has disrupted two hacking platforms—QScan and QTRouter—operated by a Chinese state-sponsored group known as QTFY. The infrastructure was employed by Nanjing Xinjiuwei Network Technology Company to target critical infrastructure and other sensitive networks in the United States, with the aim of stealing data. The disruption action is intended to prevent further unauthorized access, though it does not reverse data previously exfiltrated.

What should defenders do?

Organizations should implement enhanced network monitoring, share indicators of compromise with relevant ISACs and CISA, rotate credentials potentially exposed in prior operations, and review network segmentation to limit lateral movement. No software patch is available for this infrastructure disruption.

highThreat Intelligence

FBI Disrupts China-Linked QTFY Infrastructure Used to Steal Data From U.S. Organizations

DoJ Announces Disruption of QScan and QTRouter Platforms Attributed to Nanjing Xinjiuwei Network Technology Company

CyberIntel DeskPublished about 1 month agoUpdated less than a minute ago1 min read

FBI Disrupts China-Linked QTFY Infrastructure Used to Steal Data From U.S. Organizations

Key Takeaways

The U.S. DoJ and FBI disrupted QScan and QTRouter, hacking platforms linked to a Chinese state-sponsored group (QTFY) and Nanjing Xinjiuwei Network Technology Company.
The platforms were used to target critical infrastructure and sensitive U.S. networks for the purpose of data theft.
The disruption removes the operational capability of the identified tools but does not reverse prior data exfiltration.

Related Security News

highCyber Attacks

Star Blizzard Campaign Targets 100+ Organizations with Fake Event Invitations

Microsoft reports that the Russian state-sponsored threat actor Star Blizzard has been conducting a sustained campaign since January 2026, using fake event invitations to trick targets into installing a backdoor on Windows computers. The operation has affected more than 100 organizations, primarily in the U.S. and U.K., with victims tied to Ukraine. At least one infection has been confirmed, though the full extent of breaches and data exfiltration remains unverified.

The Hacker Newsabout 5 hours ago1 min read