The FBI Disabled Hacking Tools That Hid Behind Infected Routers

U.S. authorities seized three internet domains and disabled two connected hacking platforms that allegedly helped China-linked operators scan for vulnerable systems and disguise attacks behind compromised routers and other devices. The Justice Department says QScan and QTRouter were used against government agencies and critical infrastructure from at least 2018.

Key Number: An FBI affidavit says QScan processed more than two million scanning and exploitation tasks on a single day in 2024.

Two tools performed different jobs

According to the Justice Department’s August 26 announcement, QScan searched the internet for exposed systems, tried known exploits and infected vulnerable Internet of Things devices. Those devices could then join QTRouter, an obfuscation network that also used commercial proxy services and rented servers.

The result was a distributed relay system. An attack launched from China could appear to come from a compromised router near the victim or from ordinary VPN traffic elsewhere. That made malicious activity harder to separate from legitimate connections and complicated attribution.

Why three domain seizures were enough

The seized domains were embedded directly in the malware and used for communication and authentication. Redirecting control of them cut essential links that QScan and QTRouter needed to operate. A joint NSA and FBI warning also released detection indicators and advised organizations to update exposed devices, isolate critical systems from edge equipment and hunt for evidence of compromise.

The government attributes the platforms to a group it calls QTFY, allegedly employed by Nanjing Xinjiuwei Network Technology Company and serving customers that included China’s Ministry of State Security and military. Reuters reports that China’s embassy said it was unfamiliar with the specific case and that Beijing opposes cyberattacks.

A broad victim and target list

Authorities named NASA, the Federal Reserve, the departments of Justice, Energy, and Health and Human Services, the National Institutes of Health, and the U.S. Senate in the court record. Hospitals, power companies, telecom providers, financial institutions and defence contractors were also targeted. The disclosure follows earlier evidence that cyberattacks had reached water-system controls in several U.S. states, although the operations are not presented as the same campaign.

What defenders can do now

The technical advisory gives network operators indicators to search for, but the wider lesson is operational: internet-facing routers, VPN gateways and other edge devices can become both entry points and cover for attacks on somebody else. Patching them, separating them from sensitive systems and watching unusual outbound connections matter even when the device itself stores little valuable data.