DOJ Seizes Hard-Coded Domains to Disable QScan QTRouter Platforms Linked to QTFY

The platforms enabled automated IoT infection via QScan and traffic laundering through compromised routers and cameras via QTRouter, allowing QTFY actors to mask origins as non-Chinese or local threats. Court filings detail exploitation of a 2019 Pulse Secure VPN flaw at NASA, with IP and email traces leading investigators to the Nanjing firm; the Senate incident this year extended monitoring that began in 2018. DOJ and FBI attribute the tools directly to Ministry of State Security and PLA clients purchasing data and services, yet provide only infrastructure seizure evidence without independent packet captures or code samples confirming state tasking beyond commercial sales. This action fits a documented sequence of domain and malware removals against Volt Typhoon and Flax Typhoon infrastructure in 2024, indicating sustained focus on Chinese proxy networks rather than singular attribution claims. Next operations will likely target remaining customer-facing scanning services sold by the same contractor network.