Executive summary
Augur Security has identified a sophisticated cyber espionage campaign orchestrated by the threat group QTFY, an advanced entity sponsored by the Chinese state. The group focuses its operational efforts primarily on compromising global military assets and critical infrastructure networks. Rather than seeking immediate data theft, QTFY prioritizes silent preparatory positioning within sensitive enterprise frameworks by deploying custom distributed systems designed to maintain covert access over extended periods.
The campaign's technical foundation relies on multinode proxy networks and specialized command-and-control staging infrastructure. By routing operational traffic through compromised edge devices alongside commercial infrastructure, the group obscures its origin telemetry to blend seamlessly into normal network activity. Despite these evasive measures, predictive threat intelligence enabled security research teams and government authorities to map and neutralize QTFY staging infrastructure prior to full operational deployment. This proactive intervention severed control frameworks before the threat actor could execute lateral movement or deploy active payloads inside targeted operational environments.
Augur Security assesses with high confidence that QTFY represents an enduring top-tier espionage threat. Although recent coordinated infrastructure disruptions temporarily severed key operational nodes, the actor relies on a modular system architecture backed by state resources that ensure rapid infrastructure regeneration. Consequently, network defenders must look beyond basic indicators of compromise and focus instead on detecting anomalous edge-device behavior and identifying persistent proxy communications traversing the enterprise.
Background
Nanjing Xinjiuwei Network Technology Company serves as the commercial front for QTFY, an advanced threat group that has executed state-sponsored cyber espionage operations since at least 2018. Operating under an outsourced contractor model, the entity functions as an infrastructure quartermaster, developing custom exploitation engines and maintaining operational relay architectures for state intelligence clients, including the Ministry of State Security and the People's Liberation Army. Beyond custom tool development and 0-day research, QTFY also provides initial access, supplying prepositioned operational footholds and prepared exploits to downstream threat clusters targeting defence contractors and critical infrastructure across the West.
The technical core of QTFY operations relies on two mutually dependent proprietary software suites: QScan and QTRouter. QScan functions as an automated mass reconnaissance platform designed to identify internet-facing edge vulnerabilities across perimeter appliances and systematically infect exposed endpoints at scale. Once compromised, these edge devices (including: OpenWrt-based routers, vulnerabilities in Check Point Quantum Gateway and Ivanti Cloud Services Appliance devices as well as scanning and infecting thousands of small office/home office devices globally) are immediately ingested into QTRouter, a proprietary proxy and obfuscation mesh that dynamically encapsulates and routes malicious command-and-control traffic through multihop intermediate relays. The group targeted OpenWrt-based routers, as well as vulnerabilities in Check Point Quantum Gateway and Ivanti Cloud Services Appliance devices to target power and telecommunication firms. The group also scanned and infected thousands of small office/home office (SOHO) devices globally, quietly turning IoT hardware into their malicious fleet. This operational architecture conceals origin telemetry by forcing outbound connection attempts to emerge from benign third-party network addresses. Both platforms depend on hard-coded control domains embedded directly in compiled binaries for node authentication and dynamic task distribution.
In August 2026, a joint law enforcement action led by the Federal Bureau of Investigation in coordination with the Department of Justice executed court-authorized seizures targeting QTFY control platforms. Crucially, prior to this government intervention, Augur Security identified and cataloged 30 key indicators of compromise tied directly to QTFY staging servers and domain assets months and in many cases years ahead of weaponization. This preemptive identification shielded Augur-protected organizations and severed active communication channels before federal authorities executed their public domain takedown.
This enforcement action exposed a fundamental evolution in how state-sponsored actors maintain strategic persistence, shifting focus from traditional endpoint malware implants toward infrastructure-level prepositioning. By providing operational teams with turnkey scanning frameworks and prebuilt proxy chains, QTFY significantly reduced operational friction for state-backed intrusion campaigns. Although the August 2026 court seizures crippled primary control platforms and severed central QTRouter relay pathways, Augur Security intelligence confirms that QTFY maintainers routinely embed operational redundancies across secondary proxy tiers. The underlying threat model remains active as the group attempts to reconstruct command channels through alternate corporate disguises.
Exploitation
Augur tracking found that QTFY initial access vectors often revolved around weaponizing zero-day and unpatched high-severity vulnerabilities in perimeter edge infrastructure, chiefly enterprise firewalls and virtual private network appliances. The threat actor leverages its QScan platform to continuously map enterprise subnets and identify exposed management interfaces, allowing them to inject raw shellcode directly into active daemon process memory. Executing memory-resident payloads exclusively within volatile RAM allowed operator payloads to bypass disk-based endpoint detection mechanisms entirely and leave zero file system artifacts on infected devices. Upon achieving in-memory execution, operators deployed minimal web and bind shell listeners directly within network device daemons, establishing silent footholds without triggering standard EDR alert thresholds.
After gaining perimeter access, QTFY operators immediately shift to living-off-the-land tradecraft to navigate internal networks without dropping secondary compiled binaries. Augur telemetry indicates that operators manipulate legitimate administrative tools, abusing Windows Management Instrumentation alongside PowerShell to execute internal host discovery and map domain relationships. To enable lateral movement, operators execute in-memory credential harvesting against the Local Security Authority Subsystem Service process memory, extracting valid administrative credentials and active Kerberos tickets. This allows the actor to hijack legitimate user sessions and move laterally across internal subnets via standard Server Message Block connections, seamlessly disguising malicious administrative actions inside legitimate network telemetry.
To secure persistent access across compromised environments, QTFY deploys a custom multinode distributed framework managed via its QTRouter infrastructure. Augur threat intelligence confirms that this platform transforms infected internal endpoints into a decentralized peer-to-peer command mesh. The internal nodes encapsulate command-and-control traffic within standard encrypted enterprise protocols like Transport Layer Security, routing instructions across intermediate internal relays before egressing through compromised edge appliances. By scaling this peer-to-peer mesh architecture across global defense logistics and critical infrastructure networks, QTFY maintains resilient operational access even if primary perimeter egress channels are identified and severed by security teams.
Actor Overview
QFTY, also tracked officially as Nanjing Xinjiuwei Network Technology Co., Ltd. (南京鑫玖维网络科技有限公司), functions as the corporate front shell for QTFY, an offensive cyber contractor providing operational infrastructure and tactical enablement to China's Ministry of State Security (MSS) and People's Liberation Army (PLA) since at least 2018. Unsealed federal court filings and FBI advisories reveal that QTFY operates as a commercialized "Scan Factory" within the PRC's broader cyber enabler ecosystem. The entity's core leadership comprises former PLA cyber officers who transitioned into the private sector to monetize legacy state intelligence connections. These ex-military operators manage Nanjing Xinjiuwei under a standard corporate model (complete with software developers, project managers, and sales personnel), bidding on and executing cyber espionage subcontracts for state intelligence units and domestic cybersecurity vendors seeking specialized, high-volume exploit delivery.
To sustain its offensive capabilities, QTFY operates as an exploit aggregator by integrating deeply into PRC freelance black-hat networks and underground exploit marketplaces. Rather than relying exclusively on in-house research, the contractor sources zero-day vectors, N-day payloads, and specialized malware components from independent Chinese developers and extensive affiliate connections in the exploit marketplace. The core of QTFY's offensive platform is QScan, a C++ automated mass-reconnaissance and weaponization engine powered by an integrated database of over 200 distinct Python exploit scripts targeting perimeter enterprise edge software. QScan systematically crawls global IPv4 address spaces, logs TLS certificate chains, and indexes exposed edge interface banners. Upon identifying perimeter vulnerabilities, like QFTY’s preferred targeting of zero-days in Ivanti Cloud Services Appliances, QScan injects raw shellcode directly into active daemon process memory (httpd, sshd), bypassing disk-bound EDR agents to achieve fileless execution and immediately enroll compromised devices into the actor's proxy architecture.
Compromised endpoints are automatically ingested into QTRouter, QTFY’s proprietary multi-tier proxy mesh. QTRouter encapsulates operational C2 traffic within mTLS and AES-encrypted tunnels, routing malicious payload streams through multi-hop residential proxy nodes and compromised edge hardware to force outbound connections to emerge from benign regional IP addresses. Post-exploitation tradecraft relies on living-off-the-land execution; operators abuse WMI and PowerShell to trigger in-memory LSASS dumps, harvesting valid NTLM hashes and Kerberos tickets to move laterally via SMB and WinRM. Once QTFY secures internal footholds, it establishes peer-to-peer C2 nodes that encapsulate lateral traffic within standard TLS flows before relaying it through QTRouter egress points. This commercialized infrastructure supported long-term espionage campaigns against the U.S. Senate, NASA, the Federal Reserve, Department of Energy national laboratories, the DOJ, and defense contractors until August 2026, when a joint FBI/DOJ enforcement action seized the hardcoded seed domains embedded in QScan and QTRouter binaries, breaking node authentication handshakes and rendering the proxy architecture operationally inert.
Augur Assessment
Augur's behavioral clustering engine began flagging QTFY infrastructure years before the FBI, NSA, and Cyber National Mission Force published their joint advisory on August 26, 2026.
Indicators including 185.62.189[.]42, 188.209.49[.]95, and 185.126.116[.]236 were predicted by Augur in 2015, with government first-observed dates ranging from 2018 to 2021, representing lead windows of two to five and a half years.
The most striking single data point is 194.104.10[.]58, flagged by Augur in January 2020 and tied to the bulletproof provider AS41745 (Baykov Ilya Sergeevich), which does not appear in the advisory's confirmed first-seen data until March 2026; a six-year lead. Organizations using Augur's predictive threat intelligence had the opportunity to block this infrastructure at the network perimeter before QTFY completed a single confirmed intrusion against any target in the advisory's timeline.
The scope of Augur's predictive coverage against QTFY spans twelve behavioral clusters across Profiles 95078, 101648, 83901, 6608, 111987, 48974, 7979, 58415, 87289, 148937, 109937, and 96141. The infrastructure pattern across these clusters matches QTFY's documented procurement model: deliberate use of high-abuse-tolerance providers, including M247 and AS212238 (CDNEXT / Datacamp Limited), for operational nodes, alongside bulletproof-registered ASNs for persistence infrastructure.
Additionally, Augur's ASN enrichment against its internal hoster registry flagged these provider relationships as suspicious, months before public attribution to QTFY existed in Western reporting. The phishing domains flagged as QTFY-affiliated (huntger[.]store, whtsapp[.]online, ccgv[.]me, and vigorlabs[.]info) were similarly predicted through Augur's domain clustering logic and appear confirmed in the advisory's Table 5 with registration windows that overlap directly with documented QTFY targeting activity against US defense contractors and government networks. vigorlabs[.]info alone carries a lead window exceeding ten years between Augur's initial prediction and the advisory's publication.
QTFY's QScan platform processed over two million scanning and penetration tasks in a single day in 2024, and the group's documented targeting of the US Department of Energy, the Federal Reserve, NASA, and three DOE national labs through zero-day Ivanti vulnerabilities in September 2024 all fall within windows where the underlying infrastructure was already predicted by Augur.
The FBI/NSA advisory confirms that QTFY's September 2024 Ivanti zero-day campaign against three Department of Energy labs, NIH, and federal health infrastructure was launched directly after one of China's annual HVV national cyber exercises, a government-mandated competition run by the Ministry of Public Security in which private contractors, state-linked hackers, and groups like QTFY participate on the offensive side and sharpen capabilities against domestic critical infrastructure systems before deploying them against real espionage targets.
An organization using Augur at the network perimeter and cross-referencing against Augur’s bulletproof hoster registry would have had QTFY's scanning and obfuscation nodes in its block list before the advisory's intrusion timeline was announced.
QTFY IOC Lead Times
Defensive Mitigations
Defenders should prioritize breaking QTFY’s C2 proxy at the perimeter before payload execution. Security Operations Centers must implement proactive egress and inbound DNS sinkholing to block known seed infrastructure and domain assets associated with QScan and QTRouter. Applying behavioral edge filtering to drop outbound TLS and mTLS connections attempting to initiate handshakes with uncategorized external IP spaces disrupts node authentication. Severing these communication channels preemptively renders QScan's automated payload delivery ineffective, neutralizing the threat actor at the initial access layer before internal lateral movement or memory injection can execute.
Perimeter Appliance Hardening & In-Memory Inspection
Given QTFY’s reliance on zero-day and N-day exploitation across perimeter appliances (e.g., Ivanti Cloud Services Appliances, Check Point Quantum Gateways), isolate edge hardware from direct internet exposure where feasible.
- Management Interface Isolation: Restrict access to firewalls, VPN gateways, and edge appliance management consoles to internal administrative subnets and dedicated internal networks.
- Volatile Memory Auditing: Deploy specialized telemetry collectors capable of inspecting volatile daemon RAM (httpd, sshd) to detect injected shellcode and anomalous process hooks that bypass disk-bound Endpoint Detection and Response (EDR) agents.
- Rapid Patch Management Pipelines: Maintain expedited patching SLA cycles for external perimeter appliances to limit the vulnerability window QScan’s automated exploit engine targets.
Detection & Containment of Living-off-the-Land Tradecraft
QTFY operators manipulate native system administrative binaries to navigate internal networks post-compromise, meaning security teams must deploy strict behavioral monitoring across host environments:
- LSASS Process Protection: Enable Credential Guard and enforce strict rules restricting unauthorized process memory reads against lsass.exe to block LSASS dumps, preventing the harvesting of valid NTLM hashes and Kerberos ticket-granting tickets.
- Administrative Tool Telemetry: Enforce Script Block Logging and AMSI inspection for PowerShell and WMI execution. Monitor for unusual command-line invocations initiating host discovery, remote process creation via WinRM, or SMB lateral transfers.
- Internal Segmentation & P2P C2 Disruption: Implement zero-trust microsegmentation between workstations and servers to block lateral peer-to-peer communications. Inspect internal cross-zone TLS traffic for anomalous mTLS handshakes and non-standard certificate authorities to detect internal QTRouter mesh nodes attempting to relay C2 traffic.
For questions or additional analysis, contact: research@augursecurity.com
