The IoT Botnet That Hid Chinese State Hacks Is Dead — And Your Camera Might Have Been Its Proxy

The cleanest win of the domain-seizure era//

Most domain seizures are a mixed bag: the actor's C2 server dies, the malware keeps a dead address in its brain, and a patient operator re-hosts a year later. This one is different.

According to the court documents unsealed in the Southern District of California, the seized domains were hard-coded into both QScan and QTRouter and used for essential tasks like communication and authentication. That means the seizure bricked the tools themselves. QScan and QTRouter are, per the DOJ, "inoperable" as of the seizure. When the address is burned into the malware, there's no fallback, no re-keying ceremony. You win once and you win for good.

Who is QTFY, and what do the two tools do//

The group goes by QTFY (also QT, QTCYBER) and is attributed to Nanjing Xinjiuwei Network Technology Co., a PRC company that the FBI/NSA/CNMF joint advisory (JCSA-20260826-01) describes as an enabling company for Chinese cyber operations, with business relationships with Ministry of State Security units and actors including former PLA members. It sells hacking services to paying customers, and the DOJ names the MSS and the PLA explicitly. The group has been active since 2018 and has also been buying and selling exploits and victim access in China-based freelance brokering networks.

It runs two complementary products:

• QScan: a scanner that auto-infects thousands of IoT devices worldwide (cameras, routers, set-top boxes, the usual never-patched population) and enrolls them into QTFY's controlled fleet.
• QTRouter: the obfuscation network, built from compromised IoT devices plus commercial proxy service devices and leased VPS, used to route the attacker's traffic so it appears to come from outside the PRC, and can even appear to come from inside the target's own region.

That second part is the whole trick. A nation state wants more than entry; it wants your SIEM to think the attack came from your own datacenter or a random residential IP in Ohio. QTRouter is how you make Beijing look like Ohio.

The "quartermaster" framing (and why it's a good one)//

Lumen's Black Lotus Labs spent a year tracking the same infrastructure and named the pattern: an infrastructure quartermaster, a private company provisioning access, routing, and obfuscation at scale for multiple state-aligned customers at once. Their breakdown has four moving parts:

• QScan: recon, to identify and profile high-value targets.
• Fast Labyrinth: the encrypted relay network that does the actual traffic obfuscation.
• QTRouter: the physical "operational relay box" that operators log into to reach the proxy management plane.
• QTProxy: the control layer that manages the relay nodes, letting operators use preconfigured paths or tailor routes to a target.

The interesting engineering detail: instead of manually compromising tens of thousands of IoT boxes to build a relay mesh, QTFY bought high-tier subscriptions to commercial "Airport" networks (China's commercial proxy ecosystem built to get around the Great Firewall, specifically a service called fastlink.ws) and co-opted selected egress nodes from it. Lumen's telemetry shows Fast Labyrinth egress nodes resolving to flanycast-xxxx.yotocloud.com and flnode-xxxx.yotocloud.com subdomains consistently initiating traffic toward high-value targets. If your logs talk to yotocloud.com, you've already met the network.

Lumen's point about taking down a shared quartermaster is worth repeating: it systematically degrades multiple active threat campaigns at once, because every customer of the service loses their stealth layer in one stroke. That's what the DOJ just did.

How the thing actually works (the technical meat)//

Black Lotus Labs published the architecture, and it's worth a section because it shows how industrialized "cheap IoT + state actors" has gotten:

QScan — the scanner, in three stages:

1. A central task broker at mq-task.qt-proxy.org runs a Celery + RabbitMQ stack that stages and distributes scanning tasks.
2. A distributed scanner fleet — globally dispersed worker nodes that programmatically rotate across distinct /24 subnet blocks on a 30-day lifecycle to dodge threshold-based detection.
3. A central aggregation backend: workers compress and stream what they find (application banners, open ports, config states) back to a Redis cluster at mq-result.qt-proxy.org.

That's not a script on a laptop. That's a task queue with a scanner pool and a results database — the same shape you'd build for a SaaS scanning product, just aimed at foreign perimeters.

The admin plane: operators authenticate through a QTRouter device to reach www.qtproxy.xyz, the "Proxy Node Management System" web panel used to coordinate link paths and adjust forwarding rules. Lumen's telemetry shows management check-ins from China Telecom and China Unicom IP space assigned to Nanjing, interlaced with sessions from the yotocloud.com egress nodes. Same people who built it were calibrating the co-opted fastlink.ws nodes before leasing access to customers.

The two-track targeting strategy is the part that maps best onto real defenders:

• Broad perimeter defense profiling against highly defended federal, intelligence, and military allocations — continuous sweeps that get filtered out, but build a long-term catalog of active boundary interfaces and configuration drift.
• Precision interrogation loops against specialized corporate, scientific, and infrastructure verticals — with the broad engine suppressed, workers run quiet high-port application sweeps tuned to extract OS kernel fingerprints, map trust boundaries, and find responsive remote-management interfaces.

And the "empirical target intersect" is the confirmation that closes the loop: networks that QScan mapped or probed were later observed receiving inbound connections from Fast Labyrinth proxies during the same tracking window — scouts flag a target, the operator transitions from probing to attempted exploitation, and the interactive sessions move through the obfuscated mesh. Lumen's egress telemetry puts the focus on research universities (advanced physics, bioinformatics, aerospace), US military and defense networks, geologic and environmental agencies, and European infrastructure and judicial nodes.

So the whole machine is: scan it (QScan), remember it (Redis), route through it invisibly (Fast Labyrinth), and manage it from a box (QTRouter) you can point at with an admin panel. Take out the admin domains — the ones hard-coded into the malware — and the machine stalls.

The named targets, and the series this belongs to//

QTFY's victims per the court documents: NASA, the Federal Reserve, the Department of Energy, the Department of Justice, HHS, the NIH, and the U.S. Senate — with the CSA adding defense industrial base, telecommunications, local government, and higher education to the targeting picture.

The quotes are worth two lines each, because they're short:

"State-sponsored malicious hackers preying on America's critical infrastructure will be stopped and prosecuted." (Attorney General Todd Blanche)

"These tools were used by PRC cyber actors to hide the origin of their attacks." (FBI Director Kash Patel)

This is also part of a recognizable series of court-authorized technical operations against PRC obfuscation infrastructure: Volt Typhoon's botnet disrupted in 2023, Flax Typhoon's hundreds-of-thousands-of-IoT-devices botnet disabled in 2024, and Mustang Panda's PlugX malware removed from over 4,000 U.S. computers in 2025. Each one targets the same shape: a state sponsor, a cheap device fleet, and a stealth layer on top.

What you can actually do with this//

The CSA's "Key Actions" are three lines, and they're the right three lines:

1. Apply the latest software and firmware updates to your devices — QScan's prey is unpatched IoT.
2. Protect operational information from unintentional disclosure via internet-facing applications.
3. Isolate critical systems from edge devices — the IoT fleet is the exit node, your critical systems are the payload.

And the part most advisories skip: the IOCs are downloadable CSVs, not buried in a PDF appendix.

• QTFY_IOC_Files.csv — file hashes and file indicators
• QTFY_IOC_Infrastructure.csv — domains, IPs, and infrastructure

If you run your own DNS log, proxy log, or any flow data, this is a legitimate grep session. The infrastructure CSV's columns are type, indicator, first_seen, last_seen, description, with type values of domain or ipv4, so you pull the indicator column from the domain rows:

# domain indicators only, out of the infrastructure CSV
awk -F, '$1=="domain" {print $2}' QTFY_IOC_Infrastructure.csv > qtfy_domains.txt
# then grep your logs for anything that ever talked to them
grep -iF -f qtfy_domains.txt /var/log/proxy/access.log

You're not hunting a zero-day; you're hunting infrastructure that was good enough to hide the Fed, NASA, and the Senate from their own people for eight years.