Actor Profile

QTFY (also tracked as QT, QTCYBER) is a China-based threat actor operating as a technical "quartermaster" providing reconnaissance, proxy management, and operational routing capabilities for Chinese cyber espionage operations. The group is employed by Nanjing Xinjiuwei Network Technology Company, which has received payments from China's Ministry of State Security (MSS), indicating state-sponsored activity on behalf of the People's Republic of China government. Court documents reveal that QTFY includes former members of the Chinese People's Liberation Army. The actor developed and operated the QScan reconnaissance platform and QTRouter obfuscation network, offering these as reusable services to support multiple China-linked espionage operators.

TTPs (Tactics, Techniques, Procedures)

QTFY employed a sophisticated four-component operational framework: QScan for reconnaissance (T1595.002 - Active Scanning: Vulnerability Scanning) to identify high-value targets and collect open ports, application banners, OS fingerprints, and configuration data; Fast Labyrinth encrypted relay network for command and control obfuscation (T1090.003 - Proxy: Multi-hop Proxy); QTRouter physical devices providing preconfigured access to proxy infrastructure; and QTProxy management tools for relay selection and custom routing. The actor leveraged Operational Relay Box (ORB) networks (T1584.005 - Compromise Infrastructure: Botnet) by purchasing premium access to Chinese commercial proxy service fastlink.ws nodes, blending espionage traffic with legitimate consumer proxy traffic through dynamically rotating egress infrastructure. This enabled traffic obfuscation (T1001 - Data Obfuscation) and concealment of true origin points for follow-on exploitation and data exfiltration operations.

Targets & Patterns

QTFY targeted high-value U.S. organizations across multiple critical sectors. Confirmed targets include NASA, the Federal Reserve, Departments of Energy, Justice, and Health and Human Services, National Institutes of Health, and the U.S. Senate. Broader targeting patterns encompassed U.S. military and defense organizations, government networks, universities and research institutions, aerospace and bioinformatics organizations, healthcare entities, financial firms, critical infrastructure and energy companies, and enterprise software vendors. The targeting profile reflects strategic intelligence collection priorities consistent with Chinese state-sponsored espionage objectives, focusing on national security assets, advanced research, critical infrastructure, and economic/technological intelligence. The overlap between QScan reconnaissance targets and organizations later contacted through Fast Labyrinth demonstrates systematic progression from initial profiling to operational engagement for exploitation, lateral movement, persistent access, or data collection.

Historical Context

QTFY's infrastructure has been tracked by Black Lotus Labs for approximately one year prior to the August 2026 FBI disruption. The actor's use of Operational Relay Box (ORB) networks aligns with broader trends in Chinese cyber operations, as Chinese threat actors have increasingly leveraged ORBs since 2024 with intensified activity in early 2026. QTFY's quartermaster model represents an evolution from conventional ORB networks built from thousands of compromised devices, instead industrializing the creation of relay infrastructure through purchased premium access to commercial proxy services. The FBI seized three domains (qtproxy[.]xyz, qt-proxy[.]org, qt-team[.]com) used to operate the QScan and QTRouter platforms. Black Lotus Labs coordinated with the FBI and DOJ during the investigation, sharing threat intelligence with U.S. government agencies and implementing their own disruption measures by null-routing traffic to known quartermaster infrastructure points.

Defensive Recommendations

  • Monitor for reconnaissance activity consistent with T1595.002 (Active Scanning) by detecting unusual port scanning, banner grabbing, and OS fingerprinting attempts against external-facing assets
  • Implement detection for multi-hop proxy usage (T1090.003) by analyzing network traffic for suspicious relay patterns, encrypted tunneling through commercial proxy services, and connections to known Chinese proxy infrastructure including fastlink.ws nodes
  • Follow CISA and NCSC guidance for mitigating China-nexus threats, including hardening SOHO routers, firewalls, and IoT devices that may be compromised for ORB network infrastructure
  • Deploy behavioral analytics to identify anomalous egress patterns indicative of data exfiltration through dynamically rotating proxy infrastructure, as static blocking is insufficient against this threat
  • Maintain current patches and secure configurations for edge devices, and implement network segmentation to limit lateral movement following initial compromise of internet-facing systems

---

# Geopolitical Context

Geopolitical Context

The disruption of QTFY infrastructure represents a significant law enforcement action against a commercialized cyber espionage ecosystem serving Chinese state interests. The operation targeted Nanjing Xinjiuwei Network Technology Company, which court documents indicate received payments from China's Ministry of State Security (MSS) and employed former People's Liberation Army personnel. This case illustrates the blurred lines between state-directed operations and ostensibly commercial entities in China's cyber espionage apparatus. The targeting of NASA, the Federal Reserve, Departments of Energy and Justice, the National Institutes of Health, and the U.S. Senate reflects strategic intelligence collection priorities consistent with China's national security objectives. The "quartermaster" model—providing reconnaissance (QScan), encrypted relay infrastructure (Fast Labyrinth), and operational routing (QTRouter/QTProxy) as a service—demonstrates increasing industrialization and commoditization of advanced persistent threat capabilities. This infrastructure-as-a-service approach lowers barriers to entry for multiple Chinese espionage operators while providing operational security through commercial proxy networks.

State Actor Alignment

The threat actor QTFY is directly linked to the Chinese government through multiple vectors. Court documents establish that Nanjing Xinjiuwei Network Technology Company, which operates QTFY, received payments from China's Ministry of State Security, and that the group includes former members of the Chinese People's Liberation Army. The Department of Justice assessment concludes that the company "conducts malicious cyber activities on behalf of the PRC Government." This attribution is unusually explicit for U.S. law enforcement disclosures and reflects high confidence in the state nexus. The targeting pattern—spanning defense, aerospace, government agencies, research institutions, and critical infrastructure—aligns with Chinese strategic intelligence collection priorities documented in previous U.S. government assessments. The use of Operational Relay Box (ORB) networks and commercial proxy services (fastlink.ws) to obfuscate attribution is consistent with tradecraft observed across multiple China-nexus threat groups since 2024.

Business Impacty pro region

This disruption carries implications beyond bilateral U.S.-China tensions. The "quartermaster" model—providing turnkey espionage infrastructure to multiple operators—suggests that similar capabilities may be deployed against allied nations sharing intelligence equities with the United States. European critical infrastructure, defense contractors, and research institutions conducting sensitive work in aerospace, bioinformatics, and emerging technologies may face parallel targeting through analogous platforms. The FBI's domain seizures (qtproxy[.]xyz, qt-proxy[.]org, qt-team[.]com) and Lumen's null-routing of known infrastructure represent coordinated public-private disruption, but researchers warn that static blocking is unlikely to remain effective given the platform's reliance on dynamically rotating commercial proxy services. CISA and NCSC guidance for mitigating China-nexus threats becomes increasingly relevant for NATO allies and Five Eyes partners. The case also highlights the challenge of defending against adversaries who blend espionage traffic with legitimate commercial proxy usage, complicating network defense for organizations across allied nations.

Forecast

If Chinese state-linked actors continue to leverage commercialized quartermaster infrastructure, defenders should expect persistent reconnaissance and exploitation attempts routed through dynamically rotating proxy networks that evade static blocking measures. The disruption of QTFY may temporarily degrade operational tempo for dependent threat groups, but the underlying commercial proxy ecosystem (exemplified by fastlink.ws) is likely to remain accessible to Chinese espionage operators. If similar infrastructure-as-a-service platforms emerge to fill the operational gap, the barrier to entry for sophisticated espionage campaigns may continue to decline. Organizations in sectors previously targeted by QTFY—particularly defense, aerospace, government, research institutions, and critical infrastructure—should anticipate follow-on activity using alternative relay networks. If U.S. and allied governments pursue additional legal and technical actions against commercial proxy providers facilitating state-sponsored espionage, the operational calculus for Chinese threat actors may shift toward greater investment in proprietary infrastructure, potentially increasing costs but also reducing visibility for defenders. Implementation of CISA and NCSC mitigation guidance, particularly for edge devices (routers, firewalls, IoT), will be critical in the near term as adversaries seek alternative ingress vectors.