DoJ Affidavit Shows QTFY Sold QScan Access to Third Parties for IoT ORB Networks

The original statement listed NASA, Federal Reserve, DOE, DOJ, HHS, NIH, and Senate as victims of QTFY intrusions. The revised release aligns the text with the unsealed affidavit, which details targeting via CVE-2019-11510 against Pulse Secure VPN but provides no post-exploitation artifacts or data exfiltration evidence for those entities. QTFY, operating as Nanjing Xinjiuwei Network Technology Co under MSS payments since 2018, functions as a quartermaster selling QScan and QTRouter access rather than conducting all operations itself.

Lumen Black Lotus Labs reporting on Fast Labyrinth documents the same infrastructure pattern: QScan identifies vulnerable IoT devices that are then enrolled into QTRouter ORB meshes blending leased VPS nodes from fastlink.ws with compromised residential routers. This architecture allows customer actors to route espionage traffic locally to targets while obscuring origin. The FBI seizure of qtproxy.xyz, qt-proxy.org, and qt-team.com disrupts the current iteration but leaves the commercial sales model intact.

The correction exposes a recurring gap between initial attribution statements and later affidavit language, where "victim" claims are walked back once technical evidence of successful compromise is required. This suggests agencies detected scanning and attempted exploitation but not successful persistence or data theft in the cited cases.

Next steps center on whether additional domain seizures or sanctions target the commercial proxy layer and whether QTFY customers appear in subsequent indictments.