US DOJ Disrupts China‑Linked QTFY Hacking Platforms

On Wednesday the United States Department of Justice announced it disrupted two hacking platforms—QScan and QTRouter—operated by a Chinese threat actor group known as QTFY. Those platforms were used to target critical infrastructure and other sensitive networks in the country, according to a report from The Hacker News. The disruption was attributed to Nanjing Xinjiuwei Network Technology Company (南京鑫玖维网络科技有限公司), which is believed to employ QTFY for state-sponsored operations. ¹

Security researchers say the QScan and QTRouter systems likely employed DLL sideloading techniques to inject malicious code into legitimate system processes. This method has been documented since at least 2015 and mirrors tactics seen in earlier supply‑chain attacks such as APT41’s SolarWinds compromise in 2019. In those incidents attackers compromised widely distributed applications or software vendors to deliver malware to their targets. Expect continued use of “watering hole” techniques where attackers compromise websites frequented by targeted organizations hoping for automated infection upon visit.

The DOJ action demonstrates improved threat intelligence sharing between nations during this decade; specific network signatures associated with Nanjing Xinjiuwei’s operations appear to have been identified. While the disruption removes current infrastructure, experts note that Chinese cyber capabilities are vast and expect similar structures to be reestablished within months or years if not longer. Continued monitoring of supply‑chain attack vectors remains essential because many modern threats rely on compromising trusted third parties rather than direct intrusion attempts.

From a privacy perspective, the incident underscores how critical infrastructure can become a target for data exfiltration when insiders or external actors gain access through legitimate-looking processes. The use of DLL sideloading means defenders must scrutinize all loaded modules in running applications, not just those from official repositories. Moreover, the fact that a private company—Nanjing Xinjiuwei Network Technology Company—is believed to operate these tools indicates that state-sponsored groups often outsource or collaborate with commercial firms to obscure attribution and operational footprints.

In sum, the Department of Justice’s shutdown of QScan and QTRouter marks a significant step toward curbing foreign espionage efforts aimed at sensitive U.S. networks. It also highlights the evolving nature of cyber attacks: blending traditional malware injection techniques with sophisticated supply‑chain and watering‑hole tactics. Organizations across sectors should review their application whitelists, monitor outbound connections, and maintain robust threat intelligence feeds to detect such hidden infrastructures before they deliver stolen data.