FBI names Nanjing contractor behind 300-victim Check Point Quantum Gateway campaign

The detection problem sits in the sequencing. QScan keeps a standing database of scraped webpages, collected TLS certificates and enumerated subdomains, so when a new vulnerability drops the target list already exists ^[8][9]. Scanning is not the reconnaissance step here; it is the follow-through. The FBI puts QScan at more than two million scanning and penetration testing tasks in a single day during 2024 ^[7]. Spread across 86,400 seconds, that is roughly 23 tasks per second, sustained for a day ^[21].

Volume like that only works if it arrives from somewhere unremarkable. QTRouter is the layer that provides it: a traffic obfuscation network running on devices including routers loaded with custom OpenWrt software ^[10], fed by botnet products that fold compromised IoT devices into proxy nodes ^[11], with at least three major platforms managing those botnets ^[12]. The last hop into a victim network comes from a compromised device near the victim, blending with legitimate users ^[13]. Gabrielle Hempel of Exabeam described the result as an ecosystem designed to make malicious activity look geographically and operationally ordinary ^[14].

One line in the advisory goes past tradecraft. The FBI says unique user agent strings originating from IP addresses in China indicated QTRouter was used by QTFY personnel and by PRC government personnel ^[15]. Contractor and state operators on the same proxy fabric.

The entry point of record is an appliance. In 2024 the group exfiltrated data from more than 300 organisations in the US and globally after using an exploit for a Check Point Quantum Gateway vulnerability, with US defense contractors, financial institutions and universities among the victims ^[4]. The Infosecurity account of the advisory names the product but no CVE ^[22], which leaves anyone doing an audit matching on a product, not on a patch level. Post-access, the group holds ground with remote access trojans, web shells and legitimate credentials ^[16]. That last item sets the remediation scope: the appliance is the door, the credentials that passed through it are the residue.

QTFY was established in 2018 and has worked the defense industrial base, communications, government and higher education for close to a decade ^[3]; six years separate that start from the 2024 Check Point campaign ^[23]. The FBI attributes the group, which also uses the acronyms QT and QTCYBER, to Nanjing Xinjiuwei Network Technology Co., an enabling company for PRC-linked cyber operations ^[17]. It says the group works freelance PRC hacker networks and contracting and subcontracting marketplaces to keep pace with new exploits and techniques, including AI integration ^[19], and concentrates on zero-day and N-day flaws for initial access ^[18].

Named targets include the Department of Justice, the Federal Reserve and NASA ^[5], with attempts against hospitals and election systems ^[6]. The advisory did not state the group's aims; Infosecurity assesses espionage as the likely motivation ^[24]. Nick Tausek of Swimlane noted that even limited access to defense-linked networks yields intelligence useful well beyond the organisation first breached ^[20]. For anyone who ran a Quantum Gateway at the border in 2024, the auditable question is which credentials transited it.