FBI Disrupts Chinese Proxy Tools Used in Mass Hacking of US Agencies and Infrastructure
FBI disrupts Chinese proxy tools used in mass hacking of US agencies and infrastructure.
The FBI has disrupted QTRouter and QScan, tools used by Chinese state-sponsored hacking group QTFY to conduct extensive hacking campaigns against US government agencies and critical infrastructure. The group, allegedly part of Nanjing Xinjiuwei Network Technology Company, utilized botnets of hacked IoT devices and commercial proxy services as relay points for attacks dating back to 2018. Targeted entities included NASA, the Federal Reserve, and the US Senate, among others.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Nanjing Xinjiuwei Network Technology Company?
Get an email when a new story names Nanjing Xinjiuwei Network Technology Company, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe QTFY hacking group, linked to a Chinese government-affiliated company, leveraged compromised IoT devices and commercial proxy services to obscure attack traffic and infiltrate high-value US government and infrastructure targets over several years. The root problem lies in poorly secured IoT devices that were recruited into botnets, combined with inadequate network segmentation that allowed attackers to pivot freely once inside. This matters because proxy-chained attacks are extremely difficult to attribute and block in real time, giving adversaries a persistent, low-visibility foothold. The multi-year duration of the campaign — dating back to 2018 — also signals a critical failure in threat detection and anomaly monitoring across affected organizations.
What helps against this
How we list vendors- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.