The espionage quartermaster: China-nexus operators were buying scan and relay as a service

The useful detail in the Black Lotus Labs account is how the work was split. QScan handles targeting and only targeting: open ports, application banners, operating-system fingerprints, configuration data ^[4]. Fast Labyrinth is the encrypted relay layer that conceals traffic to and from victims ^[5]. QTProxy lets the customer pick relays and build custom routes through it ^[7], and QTRouter ships as a preconfigured physical device that connects the customer to the proxy infrastructure and node management system ^[6]. Three of the four components exist to move packets and hide where they came from; one decides who gets looked at ^[21].

That structure is what should change hunting priorities. If the same scan engine and the same relay fabric are sold as a reusable service ^[3] with egress that rotates automatically through a commercial provider's nodes ^[10], then a fingerprint seen at one victim is a property of the supplier and may be shared by several unrelated customers ^[15]. Grouping the activity under one actor's known habits is the wrong shelf to file it on.

The evidence chain deserves reading closely. Lumen says its strongest link between reconnaissance and follow-up activity is the overlap between organisations QScan profiled and organisations later contacted through Fast Labyrinth ^[11], and it assesses that the bidirectional connections it saw likely represent attempted exploitation, lateral movement, persistent access, or data collection ^[12]. Those are hedged words, and appropriately so: this is network-vantage telemetry, which can show that a victim talked back to a relay and cannot show what the session did inside. For a defender, relay contact is an unresolved incident, not a resolved one.

The supply side is the part that survives a takedown. Rather than assembling an Operational Relay Box network out of thousands of compromised SOHO routers, IoT devices and VPS hosts ^[20], the quartermaster bought premium access to selected nodes run by the Chinese commercial proxy service fastlink.ws ^[9]. That turns an engineering problem into a purchasing one, and it puts espionage sessions inside a stream of legitimate consumer proxy traffic ^[10]. Lumen frames the operation as having industrialised ORB creation for China-linked operators ^[19], against a background of Chinese actors leaning on ORBs since 2024 and pushing harder earlier this year ^[13].

Which leaves defenders with a narrower but more honest job. Reconnaissance logs stop being noise to be aged out and become triage input: if a bank of banner grabs preceded contact from a rotating proxy, that ordering is the signal Lumen itself found most convincing ^[11]. Lumen's own remediation advice is unglamorous, pointing to CISA and NCSC guidance for China-nexus threats and to keeping routers, firewalls and IoT devices patched and properly configured ^[18], which is the floor rather than the answer.

Worth noting who knew and when. Black Lotus Labs says it tracked the infrastructure for a year and shared intelligence with US government agencies during the investigation ^[2][14]. A year of visibility into a service that profiled and stole data from military, government, research, aerospace, healthcare, financial and energy targets ^[8] is a long window, and the public indicator release lands at the end of it, not the start.