DOJ Domain Seizures Disable QTFY QScan and QTRouter Infrastructure Used Against US Defense and Critical Sectors

The Justice Department executed court-authorized seizures of domains integral to QScan's vulnerability scanning of IoT devices and QTRouter's command-and-control functions. These components, operated by Nanjing Xinjiuwei Network Technology since 2018, enabled QTFY to compromise devices for traffic obfuscation while selling access to PRC state entities and freelance contractors. The FBI advisory details exploitation of 13 vendor products including Ivanti, Fortinet, and Citrix, with confirmed access to NASA, Federal Reserve, and multiple defense contractors.

QTFY's documented ties to Salt Typhoon infrastructure and i-Soon marketplaces reveal a contracting ecosystem where provincial firms subcontract offensive tooling to central intelligence requirements. This pattern aligns with procurement records showing Nanjing Xinjiuwei receiving payments routed through PRC defense-linked entities, indicating state tolerance rather than rogue activity. Failed attempts against DOE and election systems contrast with successful breaches at universities and telecom providers, exposing inconsistent perimeter defenses across critical sectors.

Disruption will force QTFY to rebuild hard-coded infrastructure, likely accelerating migration to domain-generation algorithms or cloud rendezvous points observed in prior PRC operations. Independent verification of attribution remains limited to malware signatures and domain registration data, separate from official claims of direct MSS tasking. Next indicators include renewed scanning spikes against the same vulnerability sets within 60-90 days.