DOJ Seizes QScan and QTRouter Domains Used by PRC-Linked QTFY Group Against US Agencies

US authorities disrupted the botnet by court-authorized domain seizures after identifying its use for reconnaissance and persistence against critical infrastructure. The platforms routed traffic through compromised IoT devices, commercial proxies, and leased VPS to obscure PRC origins. Primary DOJ records tie the infrastructure directly to the Nanjing firm and note exploitation of edge device vulnerabilities for initial access.

The documented pattern shows PRC actors prioritizing collection on US policy formulation, energy sector operations, and health data systems. Gains include reduced attribution risk and sustained presence inside target networks. Costs include loss of specific command infrastructure and accelerated US defensive measures such as sanctions and indictments once attribution solidifies.

Competing interests center on US requirements to protect decision-making processes versus PRC requirements for timely intelligence on technology controls and regulatory intent. No public Chinese response has been issued, consistent with prior cases where MFA statements reject attribution without engaging technical details.

Subsequent operations are expected to shift to replacement proxy layers within 90 days. US agencies will likely expand mandatory logging on edge devices and pursue additional domain seizures tied to the same actor set.