Listen to this Post
Introduction:
The FBI and the US Department of Justice have successfully disrupted a long-running Chinese state-sponsored hacking campaign that breached NASA, the Federal Reserve, the US Senate, and the Department of Justice itself. At the center of this operation were two complementary hacking platforms—QScan and QTRouter—developed and operated by the China-based contractor Nanjing Xinjiuwei Network Technology Company on behalf of the Ministry of State Security and the People’s Liberation Army. This article provides a technical deep-dive into the proxy obfuscation architecture, the domain seizure methodology, and actionable defense strategies against similar Operational Relay Box (ORB) networks.
Learning Objectives & Secrets:
- Objective 1: Understand the QScan and QTRouter proxy obfuscation architecture—how IoT device scanning, automated exploitation, and multi-hop proxying are combined to conceal the origin of state-sponsored cyber attacks.
- Objective 2 Secret Tip: Learn how hardcoded command-and-control (C2) domains become a single point of failure—and why infrastructure-level takedowns are more effective than patch-based mitigation.
- Objective 3 Secret Tip: Master the detection of ORB networks by analyzing traffic patterns that mix malicious activity with benign consumer VPN traffic—a tactic that makes traditional threat hunting significantly more difficult.
You Should Know:
1. QScan: Automated IoT Reconnaissance and Compromise
QScan is the entry point of the QTFY attack chain. According to the DOJ, QScan “scans and automatically infects thousands of
devices worldwide, which are then added to the QTRouter network". The platform continuously scans the internet for vulnerable IoT devices—routers, IP cameras, and other embedded systems—and exploits known weaknesses to enroll them into a botnet. In a single day in May 2024, QScan executed over 2 million scans and exploitation attempts, compromising more than 300 US institutions in one operation. Step-by-Step Guide: How QScan Operates and How to Defend Against It <ol> <li>Reconnaissance Phase: QScan performs mass scanning of IPv4 address space, targeting common IoT ports such as 23 (Telnet), 22 (SSH), 80/443 (HTTP/HTTPS), and 161 (SNMP). It uses banner grabbing to identify device makes and models.</p></li> <li><p>Vulnerability Matching: The platform maintains a database of known exploits for specific IoT firmware versions. It cross-references identified devices against this database to prioritize targets.</p></li> <li><p>Exploitation and Implantation: Upon successful exploitation, QScan deploys a lightweight agent that establishes outbound connections to hardcoded C2 domains.</p></li> <li><p>Botnet Enrollment: Compromised devices are registered with QTRouter and become available as proxy nodes.</p></li> </ol> <h2 style="color: yellow;">Linux Defense Commands (For Network Administrators):</h2> <p>[bash] Block outbound connections to known malicious IoT ports at the network edge iptables -A OUTPUT -p tcp --dport 23 -j DROP iptables -A OUTPUT -p tcp --dport 2323 -j DROP Monitor for unusual outbound connections from IoT subnets sudo tcpdump -i eth0 -1 'src net 192.168.100.0/24 and (dst port 23 or dst port 2323 or dst port 22)' Identify devices with open Telnet/SSH using nmap nmap -sn 192.168.100.0/24 Ping sweep first nmap -p 22,23,2323,80,443,161 192.168.100.0/24 Harden IoT devices by disabling unnecessary services For OpenWrt-based routers (the platform QTRouter runs on): uci set dropbear.@dropbear[bash].enable='0' Disable SSH if not needed uci set telnet.enabled='0' uci commit /etc/init.d/dropbear stop
Windows Defense Commands (For Network Administrators):
Block outbound IoT ports using Windows Firewall
New-1etFirewallRule -DisplayName "Block Telnet Outbound" -Direction Outbound -Protocol TCP -LocalPort 23 -Action Block
New-1etFirewallRule -DisplayName "Block Telnet Outbound Alt" -Direction Outbound -Protocol TCP -LocalPort 2323 -Action Block
Monitor active connections from IoT subnets
Get-1etTCPConnection | Where-Object {$<em>.RemotePort -eq 23 -or $</em>.RemotePort -eq 2323}
Enable advanced audit logging for IoT device authentication failures
auditpol /set /subcategory:"Logon" /success:enable /failure:enable
2. QTRouter: The Obfuscation Network
QTRouter is the heart of the QTFY proxy infrastructure. It functions as a “network traffic obfuscation network” that chains compromised IoT devices, commercial proxy services, and leased virtual private servers (VPS) into dynamic multi-hop relay paths. The DOJ explains that QTRouter “allows QTFY and other malicious cyber actors to conceal the PRC-origin of their computer intrusion activities because the malicious communications appear to originate from computers outside of the PRC and may even be local to the targeted networks”.
Step-by-Step Guide: How QTRouter Works and How to Detect It
- Node Aggregation: QTRouter maintains a dynamic inventory of available proxy nodes from three sources: QScan-compromised IoT devices, commercially rented VPS instances, and co-opted consumer VPN services.
-
Path Selection: When a QTFY operator initiates an attack, QTRouter selects a random sequence of 3–5 proxy nodes to route traffic through, creating an obfuscation chain.
-
Traffic Encryption: Each hop in the chain uses encryption to prevent intermediate nodes from inspecting payload content.
-
Domain-Based Coordination: QTRouter nodes authenticate to administration servers using hardcoded domain names, where nodes are managed and tasks are coordinated.
Detection Commands and Techniques:
Monitor for devices acting as SOCKS5 proxies (common QTRouter configuration)
sudo netstat -tulpn | grep -E ':(1080|1081|9050)'
Analyze DNS logs for queries to suspicious domains (look for patterns)
QTRouter uses domains hardcoded into the malware—monitor for any deviations
journalctl -u systemd-resolved -f | grep -E "(query|domain)"
Use Zeek (formerly Bro) to detect proxy chain patterns
Zeek script to log SOCKS proxy connections
echo 'event socks5_request(c: connection, is_orig: bool, version: count, command: count, port: count, address: string)
{
print fmt("%s -> %s:%d via SOCKS5", c$id$orig_h, address, port);
}' > /usr/local/zeek/share/zeek/site/socks5.zeek
Deploy Snort rule to detect QTRouter-style C2 beaconing
alert tcp $HOME_NET any -> any any (msg:"QTRouter C2 Beacon"; \
content:"|00 01 00 00|"; depth:4; flow:to_server,established; \
classtype:trojan-activity; sid:1000001;)
3. Domain Seizure: The Takedown Mechanism
The FBI’s disruption operation targeted a critical architectural weakness: QScan and QTRouter had C2 domains hardcoded into their binaries. By obtaining court authorization to seize these domains, the FBI effectively severed the communication channel between the botnet nodes and their command infrastructure. Lumen Technologies, an internet backbone provider, further “null-routed” certain domains, rendering them inoperable—including the more recent system of co-opting censorship-bypassing VPNs.
Step-by-Step Guide: Domain Seizure and Infrastructure Disruption
- Intelligence Gathering: Private-sector partners like Lumen’s Black Lotus Labs identified the domains used by QTFY through network traffic analysis and reverse engineering of QScan/QTRouter samples.
-
Legal Authorization: The DOJ obtained a court order authorizing the seizure of the identified domains.
-
Technical Execution: The FBI took control of the domain names, redirecting them to sinkhole servers that log connection attempts from infected devices.
-
Null-Routing: Lumen null-routed traffic to the identified domains at the backbone level, preventing any device from resolving them.
Incident Response Commands:
For organizations that may have QScan-compromised IoT devices: Check for suspicious outbound DNS queries sudo tcpdump -i any -1 'udp port 53' | grep -E "(qscan|qtrouter|qtfy)" Isolate potentially compromised devices Create a quarantine VLAN and move all IoT devices to it ip link add link eth0 name eth0.100 type vlan id 100 ip addr add 192.168.100.1/24 dev eth0.100 ip link set eth0.100 up Block known QTFY-associated domains at the DNS level (add to /etc/hosts) echo "127.0.0.1 qscan[.]malicious-domain" >> /etc/hosts echo "127.0.0.1 qtrouter[.]malicious-domain" >> /etc/hosts Windows: Use PowerShell to add DNS sinkhole entries Add-Content -Path C:\Windows\System32\drivers\etc\hosts -Value "127.0.0.1 qscan.malicious-domain"
4. VPN Co-Option: The Latest Evolution
Over the past year, QTFY transitioned to hijacking VPN services typically used by Chinese citizens to bypass the Great Firewall. This created a sophisticated obfuscation layer: “It made it difficult for us to see the bad, state-sponsored traffic because there was so much typical user VPN traffic in the nodes they were co-opting,” said Damon Rouse of Lumen’s Black Lotus Labs.
Detection Strategy for VPN Co-Option:
Monitor VPN gateway traffic for anomalies Check for unusual volume or timing patterns sudo nethogs -d 2 Real-time per-process network traffic Analyze VPN tunnel logs for authentication anomalies grep -i "authentication failure" /var/log/openvpn.log grep -i "multiple connections" /var/log/openvpn.log Deploy Suricata rules to detect VPN tunnel abuse alert ip any any -> any any (msg:"Possible VPN Tunnel Co-option"; \ ip_proto:50; flow:stateless; sid:1000002;)
- Operational Relay Box (ORB) Networks: The Broader Threat Landscape
QTFY’s proxy infrastructure is part of a growing trend among China-1exus APT groups. Mandiant tracks this as “ORB networks” (Operational Relay Box networks), where compromised IoT devices, VPS instances, and commercial proxies are aggregated into dynamic relay networks. Similar tactics have been observed in the Volt Typhoon campaign, which uses compromised SOHO routers to proxy C2 traffic.
Defensive Recommendations:
- Segment IoT Networks: Place all IoT devices on isolated VLANs with strict egress filtering.
-
Implement DNS Sinkholing: Use threat intelligence feeds to block known malicious domains at the DNS resolver level.
-
Deploy Network Detection and Response (NDR): Monitor for SOCKS proxy traffic and unusual outbound connection patterns.
-
Conduct Regular Firmware Updates: Many QScan compromises exploit known vulnerabilities in unpatched IoT devices.
-
Use Behavioral Analytics: Establish baselines for IoT device behavior and alert on deviations.
What Undercode Say:
-
Key Takeaway 1: The QTFY takedown demonstrates that infrastructure-level disruptions—seizing hardcoded C2 domains—can be more effective than chasing individual vulnerabilities. The architectural inflexibility of hardcoded domains became the attacker’s Achilles’ heel.
-
Key Takeaway 2: The shift toward co-opting consumer VPN services represents a significant evolution in state-sponsored obfuscation tactics. By blending malicious traffic with legitimate VPN user traffic, attackers dramatically increase the cost and complexity of detection for defenders.
The QTFY operation reveals a sophisticated “quartermaster” model where private contractors provide turnkey hacking infrastructure to state-sponsored actors. This commercialization of cyber warfare capabilities creates a scalable, resilient supply chain for offensive cyber operations. The FBI’s disruption, while significant, is likely a temporary setback—as Rouse notes, “we can also safely assume they’ll pivot and stand up new infrastructure”. For defenders, the key takeaway is the necessity of layered defense: network segmentation, behavioral analytics, DNS-level threat intelligence, and rapid incident response capabilities. The battle against ORB networks is not about winning once—it’s about building sustained resilience against an adaptive adversary.
Prediction:
- -1 The QTFY group will likely pivot to using decentralized, peer-to-peer C2 architectures to eliminate the single point of failure exposed by this domain seizure.
- -1 The commercial “cyber quartermaster” model will continue to proliferate, making it increasingly difficult to attribute attacks to specific state actors.
- +1 The FBI-Lumen collaboration sets a precedent for public-private partnership in disrupting nation-state cyber threats, potentially inspiring similar frameworks globally.
- -1 Smaller organizations without advanced threat intelligence capabilities will remain vulnerable to ORB network-based attacks, as they lack the resources to detect sophisticated proxy obfuscation.
- -1 The co-option of consumer VPN services for malicious purposes will likely erode trust in commercial VPN providers, potentially driving users toward less secure alternatives.
▶️ Related Video (78% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: https://lnkd.in/p/er7B9G36 – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
