The tradecraft half of the release survived the edit intact. QScan is still described as the vulnerability scanning and exploitation platform, QTRouter as the obfuscation network [8]. The affidavit still puts a 2019 attempt against NASA through CVE-2019-11510 in Pulse Secure VPN [9]. The FBI's disruption of qtproxy[.]xyz, qt-proxy[.]org and qt-team[.]com stands [11]. What moved was a single word of victimology, and that word had been carrying more weight than the filing could support.
The first version listed seven federal bodies, including DoJ itself, as "some of the victims" of computer intrusion activity orchestrated by QTFY [2][16]. The revised version lists the same seven as being among the group's targets [1]. The Hacker News reads the change as narrowing broad targeting down to a smaller set of actual compromises [10]. Tally it up and the public record now shows seven organizations QTFY aimed at, and none confirmed as entered [17]. Anyone whose slide said the Federal Reserve or the Senate was breached is now citing a paragraph the government has pulled back, and the stronger version stood for about a week before that happened [18].
The correction itself reached the press through Reuters over the weekend, according to The Hacker News [3]. DoJ's own note claims no more than that the edits bring the release into line with the allegations in the affidavit supporting the domain seizures [4]. No agency has been named as compromised in the correction.
The part that should drive detection work is the routing. Lumen Black Lotus Labs describes QTFY as having industrialized operational relay box networks, a decentralized botnet of compromised IoT devices and leased VPSs that obscures where traffic originates [12]. The affidavit alleges the operators route through IoT devices local to the victim so scanning and attack traffic blends in with legitimate users [15]. Nodes from the Chinese commercial proxy service fastlink[.]ws sit in the same architecture, under an encrypted relay network the filing calls Fast Labyrinth [14]. Geography-based triage does not survive that design. A probe from an address in your own metro is the expected shape, not the exception.
Attribution gets worse from there. QTFY sells access to QScan and QTRouter to other actors, who then enlist the devices they compromise as QTRouter nodes [13]. So an infrastructure hit identifies the toolkit rather than the customer behind it. The affidavit describes the group as a technical quartermaster supplying reconnaissance, proxy management and operational routing to Chinese espionage operations rather than running every intrusion itself [7]. Payments from the Ministry of State Security to Nanjing Xinjiuwei Network Technology Co are the stated basis for tying that company's work to Beijing [5].
QTFY has been running since 2018, against hospitals, telecom operators, power companies, financial institutions and defense contractors alongside federal networks [6]. Most people reading the release will not care which agency the Senate sits next to on a victim list. What they need to know is whether their own perimeter answered a QScan probe from a residential IP down the road.
