The FBI takes down QScan and QTRouter, the obfuscation network hiding China’s intrusions

August 26, 2026. QScan. QTRouter. The U.S. Department of Justice and the FBI announced court-authorized seizures of the domains behind QScan and QTRouter, two complementary intrusion platforms operated by a Chinese group named QTFY. Employed by Nanjing Xinjiuwei Network Technology Company, the group sold its services to state clients, including the Ministry of State Security (MSS) and the People’s Liberation Army (PLA). The seizures knocked both tools offline overnight, for one simple reason: the seized domains were hard-coded into the malware.

Infrastructure, not intrusion

What was neutralized here is not an exploit but the network infrastructure that makes one invisible. QScan and QTRouter do not directly breach a target; they manufacture the anonymity layer that lets other attackers do so without being attributed. Black Lotus Labs, the threat-intelligence arm of Lumen Technologies, calls this the “quartermaster” model: an actor who, like a logistics contractor, sells reconnaissance, routing and obfuscation as a reusable service to multiple customers at once.

The architecture has four parts. QScan performs reconnaissance and infects thousands of internet-of-things devices worldwide. QTRouter is a preconfigured access device that connects operators to those relays. QTProxy administers the nodes of an encrypted relay network, and Fast Labyrinth co-opts commercial proxy infrastructure into a transit mesh. Together they turn target discovery, routing and operational access into a turnkey product.

How a Chinese origin becomes invisible

The crux is the transport layer. When an analyst sees an intrusion arrive from an IP address, they assume that address names the attacker. QTRouter breaks that assumption: malicious traffic exits through compromised machines — routers, cameras, home gateways — located outside China, sometimes inside the victim’s own network. Per the court documents, QTFY’s victims include NASA, the Federal Reserve, the Department of Energy, the Department of Justice, the Department of Health and Human Services, the National Institutes of Health and the U.S. Senate.

Black Lotus Labs documented the mechanism in detail. Rather than compromising thousands of devices one by one to assemble a relay network, the quartermaster buys high-tier subscriptions to Chinese commercial proxy networks — the “Airport” (机场) services originally built to bypass the Great Firewall. Traffic flows through obfuscation protocols such as V2Ray, Shadowsocks and Trojan, over low-latency dedicated circuits and multi-homed BGP routes. Fast Labyrinth’s egress nodes — identifiable by the flanycast-*.yotocloud.com and flnode-*.yotocloud.com subdomains — are the ones that actually reach the targets.

This shift matches a trend the CISA has documented: state-aligned groups are abandoning static, attributable VPS hosting in favor of operational relay box (ORB) networks — decentralized meshes of consumer routers, IoT devices and rented VPS. Traffic rotates through changing IPs, blends into normal internet noise, and slips past blocklists and geo-policies.

Why seizing domains worked

Operations like this often fail because the infrastructure is redundant: cut one server, the attacker spins up another. Here the seizure worked for a precise technical reason — the seized domains were hard-coded into QScan and QTRouter and used for essential tasks such as communication and authentication. Without them, the malware cannot reach its command center.

That is the deeper lesson about the fragility of obfuscation networks: the more industrialized a relay network becomes, the more it depends on centralized control points — here, domain names. That is exactly the link the FBI and the DOJ targeted, with Lumen null-routing traffic to known nodes in support.

It is not the first such operation. In 2025, the FBI removed the PlugX malware from more than 4,000 U.S. computers infected by Mustang Panda. In 2024, it disabled a botnet of hundreds of thousands of IoT devices run by Flax Typhoon. In 2023, it disrupted a Volt Typhoon botnet. The FBI and the NSA also published a joint advisory with indicators of compromise, based on analysis of QTFY activity dating back to at least 2018.

What changes for network defense

For a defender, this shifts the question. You no longer hunt only the exploit; you hunt the transit infrastructure. Three signals are worth watching: outbound flows toward commercial proxy ranges or “Airport” subdomains, inbound connections whose source address matches no coherent geolocation, and local machines that suddenly begin relaying encrypted traffic.

The pivot point is this: a shared obfuscation network is a chokepoint. Taking down one quartermaster degrades several campaigns at once. That is Black Lotus Labs’ conclusion, and it is why defenders should walk the chain upward rather than neutralizing one IP at a time.

An anonymity economy, in layers

The August 26 seizure belongs to an underground economy defenders still map poorly. The quartermaster does not work for a single campaign: it sells discretion on demand to multiple groups, who no longer need to build their own infrastructure. Black Lotus Labs links this model to earlier operations such as KV-botnet and Raptor Train, two botnets documented by the CISA that already rented transit to Chinese actors.

The operational consequence is direct. Attacking this kind of network node by node is a thankless task: every relay is one compromised machine among thousands, and the operator keeps adding more. Taking it down through its control points — domains, certificates, BGP announcement ranges — collapses it at once. That is exactly the strategy used here.

The economics also explain why this matters far beyond the U.S. government. The same quartermaster model lowers the barrier for any actor: renting an obfuscation layer is cheaper than building one, which means attribution — already hard — gets harder at the very moment the volume of unattributable intrusions rises. The operation’s real product is not two domains; it is the demonstration that the chokepoint is real and reachable.

Three concrete controls are worth putting in place:

• Log outbound DNS resolution toward known obfuscation-service subdomains (yotocloud.com, fastlink.ws) and alert on newly registered domains.
• Correlate geolocation of inbound addresses with their reputation: a “residential” IP that initiates sessions to your sensitive services is a strong signal.
• Review the IoT fleet: a device relaying encrypted traffic abroad must be isolated, not merely patched.

None of these controls needs an expensive tool; they mostly require accepting that a source IP address is no longer evidence.

Verdict

If your organization is a strategic target, add detection of commercial proxy egress nodes and “Airport”-style subdomains to your monitoring: that is where attribution fails, so that is where the attacker invests. Watching outbound DNS for freshly registered domains and obfuscation-service subdomains is the cheapest control you can deploy this week.

If you run a network, audit your routers and IoT devices: a home device relaying encrypted traffic abroad is no longer your device, it is the adversary’s relay. Origin validation (RPKI and ROV) and device hygiene (routers turned into relays) are two faces of the same requirement: keep control of what transits your network.

References

• Justice Department and FBI Seize Platforms Operated and Used by China State-Sponsored Hackers — DoJ, August 26, 2026
• FBI Disrupts China-Linked QTFY Infrastructure Used to Steal Data From U.S. Organizations — The Hacker News, August 26, 2026
• The infrastructure quartermaster: inside a China-nexus state enablement model — Lumen Black Lotus Labs, August 26, 2026