DoJ Corrects China Hacking Claim, Says U.S. Agencies Were Targets, Not Victims 司法部更正中国黑客攻击声明：美国机构是目标而非受害者

TL;DR

• The U.S. Department of Justice corrected its initial press statement, clarifying that federal agencies were targets of Chinese cyber activity rather than confirmed victims of compromise
• QTFY (QT AND QTCYBER), a state-sponsored threat actor linked to Nanjing Xinjiuwei Network Technology Co and the Ministry of State Security, has been active since 2018
• The group operates two core tools: QScan (vulnerability scanning/exploitation platform) and QTRouter (obfuscation network), which they sell to other actors
• QTFY has industrialized Operational Relay Box (ORB) networks using compromised IoT devices and leased VPSs to create decentralized botnets that mask the origins of malicious traffic
• The FBI disrupted key domains (qtproxy.xyz, qt-proxy.org, qt-team.com) connected to QScan and QTRouter, neutralizing the malware's infrastructure

Why It Matters

This correction highlights the importance of precision in government communications about cyber incidents, as the distinction between targeting and compromise carries significant implications for national security assessments and public perception. The article reveals a sophisticated, commercialized cyber espionage ecosystem where Chinese threat actors operate like a "technical quartermaster," selling access to scanning and routing tools to other adversaries—a model that complicates attribution and defense strategies. For AI and cybersecurity practitioners, the ORB network architecture represents an evolving threat vector that blends malicious traffic with legitimate activity through IoT botnets, demanding new detection approaches.

Technical Details

• QTFY operates QScan, a vulnerability scanning and exploitation platform, and QTRouter, an obfuscation network that routes malicious traffic through compromised devices to appear as legitimate users
• The Operational Relay Box (ORB) network is a decentralized botnet composed of infected IoT devices and leased virtual private servers (VPSs), combined with nodes from the commercial proxy service fastlink.ws
• Fast Labyrinth serves as the encrypted relay network layer that blends malicious traffic with legitimate internet activity, making detection significantly more difficult
• The group exploited CVE-2019-11510, a critical Pulse Secure VPN vulnerability, in attempted intrusions against NASA dating back to 2019
• QTFY's business model involves selling access to QScan and QTRouter to other threat actors, who then use compromised IoT devices as botnet nodes, creating a multi-layered ecosystem of cybercrime-as-a-service
• The DoJ affidavit confirms payments from China's Ministry of State Security to Nanjing Xinjiuwei Network Technology Co, establishing the state sponsorship linkage

Industry Insight

Organizations should reassess their IoT device security posture, as compromised smart devices are being weaponized into relay networks that can bypass traditional perimeter defenses—regular audits and network segmentation for IoT assets are now critical. The commercialization of cyber espionage tools through QTFY's sales model suggests that defensive strategies must account for the possibility that any organization could be targeted by actors using these commercially available scanning and routing platforms, making threat intelligence sharing and proactive vulnerability patching essential. The distinction between being targeted versus compromised, as clarified by the DoJ, underscores the need for robust detection and response capabilities that can identify attempted intrusions even when breaches do not occur, turning defensive monitoring into a measurable security asset.

TL;DR

• 美国司法部更正声明，将NASA、美联储等联邦机构从"受害者"改为"QTFY攻击目标"，表明并非所有被瞄准机构都已被实际入侵
• QTFY（QT AND QTCYBER）是受中国国家安全部（MSS）资助的黑客组织，为南京新九维网络科技公司工作，自2018年以来活跃
• 该组织核心产品QScan（漏洞扫描与利用平台）和QTRouter（混淆网络）已实现商业化，向其他攻击者出售访问权限
• FBI已破坏QTFY相关域名（qtproxy.xyz、qt-proxy.org、qt-team.com），但Lumen揭示其已工业化构建去中心化ORB僵尸网络
• QTFY通过QScan入侵IoT设备作为中继节点，将恶意流量与合法流量混合，实现针对关键基础设施的隐蔽侦察和攻击

为什么值得看

本文揭示了国家级APT组织从"直接攻击者"向"技术军火商"转型的新模式，QTFY通过商业化出售漏洞利用工具和匿名网络服务，降低了网络间谍活动的技术门槛。对安全从业者而言，理解这种"攻击即服务"（AaaS）的产业化运作模式，有助于完善供应链安全和IoT设备防护策略。

技术解析

• 组织架构：QTFY隶属于南京新九维网络科技公司，但资金来源于中国国家安全部（MSS），形成"私营公司+国家资助"的混合模式，这种架构便于否认归属并分散风险。
• 核心工具链：QScan是自动化漏洞扫描与利用平台，专门针对IoT设备；QTRouter是操作中继网络（ORB），由受感染的IoT设备和租赁VPS组成去中心化僵尸网络，实现攻击流量的地理伪装。
• Fast Labyrinth网络：结合中国商业代理服务fastlink.ws的节点，构建加密中继网络，将恶意流量混入正常网络活动，使攻击来源难以追溯。
• 攻击案例：2019年尝试利用Pulse Secure VPN的CVE-2019-11510漏洞入侵NASA，该漏洞允许未认证用户绕过身份验证获取系统访问权限。
• FBI反制措施：已破坏QScan和QTRouter相关域名，但Lumen指出该组织已建立分布式基础设施，单一域名处置难以彻底瓦解其能力。

行业启示

• IoT设备安全成为国家级APT的突破口：QTFY通过扫描和入侵IoT设备构建中继网络，表明消费级和工业级IoT设备已成为网络间谍活动的关键跳板，企业需加强IoT设备的安全基线和网络分段策略。
• 攻击即服务（AaaS）模式的扩散风险：QTFY将漏洞利用工具和匿名网络商业化出售，降低了高级网络攻击的技术门槛，这种"网络军火商"模式可能导致攻击活动泛滥，威胁评估模型需从单一APT组织追踪转向工具链生态监控。
• 政府声明措辞的严谨性影响安全态势感知：DoJ将"受害者"更正为"目标"，凸显网络攻击事件中"被瞄准"与"被入侵"的本质区别，企业应建立独立的威胁情报验证机制，避免过度依赖官方声明进行安全决策。