Justice says Chinese state operators laundered intrusions through infected routers and cameras in more than 130 countries since 2018. Source geography has been unreliable for years.
Perspective Coverage
7 publishers
- Builder
- Builder 32%
- Operator
- Operator 54%
- Investor
- Investor 14%
Reality
- Evidence66
- Adoption
- Insufficient
- Hype gap+18
- Incentives58
- Confidence64
Three seized domains and a roughly 390-item indicator list arrive with no named bank victim, so any institution running the listed products has to answer a multi-year exposure question out of whatever logs it happened to keep.
Reality
- Evidence66
- Adoption34
- Hype gap+18
- Incentives45
- Confidence62
Attorney General Todd Blanche says criminals worked X's password-recovery system against hundreds of thousands of accounts this week and that X stopped them. The technique is the part still undisclosed.
Reality
- Evidence30
- Adoption
- Insufficient
- Hype gap+30
- Incentives68
- Confidence38
DOJ seized three domains on 26 August 2026 and disabled the QScan and QTRouter platforms. Both were sold as services to MSS and PLA customers, and the only telemetry that ever saw the traffic sat on the backbone.
Publishers:zerotracelab.com
Reality
- Evidence74
- Adoption71
- Hype gap+12
- Incentives62
- Confidence63
The edited release now says NASA, the Federal Reserve and the Senate were among QTFY's targets. That leaves the public record with seven named agencies and no named breach for anyone to brief a board on.
Reality
- Evidence47
- Adoption38
- Hype gap+14
- Incentives61
- Confidence51
The 26 August announcement listed the Senate, the Federal Reserve and NASA among a Chinese group's victims. By 28 August they were targets, and any team that opened an incident on day one was hunting a claim the affidavit did not contain.
Reality
- Evidence58
- Adoption62
- Hype gap+25
- Incentives58
- Confidence60
A week of takedowns removed people and froze assets across five separate actions, while the kit that manufactures the stolen Microsoft 365 sessions those crews depend on still sells on Telegram for $320 a month.
Reality
- Evidence28
- Adoption52
- Hype gap+30
- Incentives58
- Confidence36
The August 26 advisory, written with the NSA and Cyber National Mission Force, describes QTFY running its own scanning, proxying and botnet platforms since 2018. Commodity indicator feeds will not find it.
Reality
- Evidence63
- Adoption
- Insufficient
- Hype gap+12
- Incentives60
- Confidence58
A court order killed two Chinese contractor hacking platforms because their command domains were hard-coded into the malware. The pivot hardware they infected is still nobody's asset.
Reality
- Evidence68
- Adoption71
- Hype gap+14
- Incentives62
- Confidence60
Prosecutors say a Nanjing contractor rented IoT botnets and commercial proxies to the MSS and PLA from 2018. No individuals were charged, and the conscripted hardware stays conscripted.
Reality
- Evidence58
- Adoption47
- Hype gap+24
- Incentives62
- Confidence61