[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhUcnlqQkkSvCDcc_Amjd6J0IYJOHYcaNN04LWtx2eEQ":3},{"article":4,"iocs":51,"watch_terms":52,"solutions":53,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"f4aafe9c-e162-4b3e-916f-1a6fca4fe1ec","FBI Disrupts Chinese Proxy Tools Used in Mass Hacking of US Agencies and Infrastructure","fbi-disrupts-chinese-proxy-tools-used-in-mass-hacking-of-us-agencies-and-infrast-ec672e","China’s hacking campaign targeted NASA, the Federal Reserve, the US Senate, the Justice Department, and more, according to the DOJ.","The FBI has disrupted QTRouter and QScan, tools used by Chinese state-sponsored hacking group QTFY to conduct extensive hacking campaigns against US government agencies and critical infrastructure. The group, allegedly part of Nanjing Xinjiuwei Network Technology Company, utilized botnets of hacked IoT devices and commercial proxy services as relay points for attacks dating back to 2018. Targeted entities included NASA, the Federal Reserve, and the US Senate, among others.","FBI disrupts Chinese proxy tools used in mass hacking of US agencies and infrastructure.","https:\u002F\u002Fwww.wired.com\u002Fstory\u002Ffbi-disrupts-chinese-proxy-tools-used-in-mass-hacking-of-us-agencies-and-infrastructure\u002F","https:\u002F\u002Fmedia.wired.com\u002Fphotos\u002F6a8f11191780b42ea223901b\u002Fmaster\u002Fpass\u002FFBIChinaHack.jpg","2026-08-26T17:57:06+00:00","2026-08-26T20:00:19.024789+00:00",9,[17,20,23,26],{"name":18,"type":19},"QTFY","threat_actor",{"name":21,"type":22},"Nanjing Xinjiuwei Network Technology Company","vendor",{"name":24,"type":25},"QTRouter","product",{"name":27,"type":25},"QScan","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":28,"icon":30,"name":31,"slug":32},null,"Nation-state","nation-state",[34,36,41,46],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,24,27],{"controls":54,"vendors":140},[55,83,112],{"slug":56,"name":57,"problem":58,"products":59},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[60,67,75],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":62,"url":65,"description":66},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"slug":84,"name":85,"problem":86,"products":87},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"slug":50,"name":113,"problem":114,"products":115},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[116,124,132],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",[],{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":158},"chinese-state-hackers-exploited-iot-botnets-and-proxy-tools-to-breach-us-agencies","Chinese State Hackers Exploited IoT Botnets and Proxy Tools to Breach US Agencies","The QTFY hacking group, linked to a Chinese government-affiliated company, leveraged compromised IoT devices and commercial proxy services to obscure attack traffic and infiltrate high-value US government and infrastructure targets over several years. The root problem lies in poorly secured IoT devices that were recruited into botnets, combined with inadequate network segmentation that allowed attackers to pivot freely once inside. This matters because proxy-chained attacks are extremely difficult to attribute and block in real time, giving adversaries a persistent, low-visibility foothold. The multi-year duration of the campaign — dating back to 2018 — also signals a critical failure in threat detection and anomaly monitoring across affected organizations.",[146,147,148,149,150,151,152,153,154,155,156,157],"CIS Control 1 – Inventory and Control of Enterprise Assets","CIS Control 13 – Network Monitoring and Defense","CIS Control 12 – Network Infrastructure Management","NIST SP 800-41 – Guidelines on Firewalls and Firewall Policy","NIST SP 800-82 – Guide to ICS\u002FOT Security","NIST CSF DE.AE-1 – Anomalies and Events Detection","NIST CSF PR.AC-5 – Network Integrity Protection (Segmentation)","NIST SP 800-207 – Zero Trust Architecture","NIST IR 8259 – Foundational Cybersecurity Activities for IoT Device Manufacturers","MITRE ATT&CK T1090 – Proxy (Defense Evasion)","MITRE ATT&CK T1584.005 – Botnet Infrastructure","Executive Order 14028 – Improving the Nation's Cybersecurity (Zero Trust mandate)",{}]