DOJ names China's proxy quartermaster; the seizure took domains, not devices

Two products were being sold here, and they are not equally hard to replace. QScan, according to Lumen and the FBI, hunted for vulnerabilities in IoT devices that could be conscripted into proxy botnets ^[9]. QTRouter managed customers' access to that botnet and to a stable of commercial virtual private servers that could simply be rented ^[10]. The botnet half runs on other people's unpatched hardware. The VPS half runs on a purchase order. Black Lotus Labs, which worked the takedown with the FBI and DOJ, describes the Nanjing firm as a quartermaster, one of several private contractors now supplying China's state hackers ^[11].

That distinction decides who carries the risk. The DOJ named seven federal bodies as breached, including NASA, the Senate, the Federal Reserve and the department itself ^[7][19]. The FBI affidavit separately lists five categories of US infrastructure and industry targeted through the proxies, and declines to say which of those entities were actually breached or how badly ^[8][20]. A hospital or a power company reading that filing learns it was in the target set and nothing more. It may also have been part of the relay layer, and the filing does not sort the two.

The obfuscation kept improving. Over the past year, researcher Damon Rouse of Black Lotus Labs says, the group moved to hijacking VPN services that Chinese citizens use to get around the Great Firewall, so that state traffic sat inside a large volume of ordinary user traffic ^[12]. Rouse says that made the state-sponsored traffic hard to pick out ^[12]. For anyone triaging alerts, that removes a heuristic rather than adding one: a connection from a consumer VPN node stops carrying information.

What was actually seized is the addressing. The FBI and DOJ took key domains hardcoded into QScan and QTRouter, and Lumen null-routed certain domains, including the newer VPN co-opting system ^[13][14]. Hardcoded domains are the cheapest part of an operation to replace and the most expensive part for a defender to notice changing. The compromised routers and cameras are untouched by a domain seizure, the rented-VPS market is untouched, and the DOJ's announcement did not appear to include charges against any individuals ^[15]. Attorney General Todd Blanche said state-sponsored hackers preying on critical infrastructure "will be stopped and prosecuted" ^[15]. Nanjing Xinjiuwei could not be immediately reached for comment ^[17].

Motive is the other blank. Prosecutors have not established what QTFY or its government clients wanted from the US infrastructure hacking, and Rouse says the campaigns do not appear to overlap with Volt Typhoon ^[16][18]. Rouse describes the campaign as long-lasting, with the people involved closely tied to the highest levels of the PLA ^[1]. Read together with the 2018 start date ^[6], the durable asset was never a tool name. It was a standing inventory of other people's devices, billed to whichever agency wanted a relay that week.