Jackal IV's 58 arrests cover under a third of the suspects INTERPOL identified

Seizing a hardcoded C2 domain breaks rendezvous for implants that carry no fallback, and it leaves every compromised router exactly as compromised as it was the day before. QScan and QTRouter existed to put consumer IoT devices between Chinese operators and their targets, according to SentinelOne's week 35 roundup, which credits the group QTFY with direct ties to China's military and intelligence services and names the Federal Reserve and NASA among the targeted US networks ^[3][18]. That relay layer is a telemetry problem: espionage traffic arrives from residential address space, where geography and reputation scoring read it as consumer noise. The FBI and DoJ took the core domains written into the frameworks ^[4]. What that buys a defender is retrospective, because any historical resolution of those names in DNS or proxy logs is now a finding. The roundup does not publish them.

On the fraud side the numbers set the ceiling. Jackal IV produced 58 arrests against more than 200 identified suspects across 22 nations ^[1], which leaves at least 142 people named and not in custody ^[12] and puts arrest coverage under 30% of the identified set ^[13]. The operation dismantled elements of Black Axe, and the evidence stops short of the syndicate itself ^[2]. BEC runs on mailbox access and a plausible payment instruction rather than on hosting, so removing headcount from the syndicate behind romance, investment and BEC schemes ^[2] does not change what a remaining operator can send tomorrow.

The same roundup prices the replacement capability. NovaCookies, a variant of Sneaky2FA sold on Telegram at $320 monthly ^[7][10], works out to $3,840 a year ^[14] for an adversary-in-the-middle proxy already used against hundreds of organizations in the US, UK, Germany and the UAE ^[7]. The lure ships inside a genuine DocuSign notification, so it clears sender authentication and reputation filters on the way in, and the malicious link sits inside the shared document, below where most gateways inspect ^[8]. From there an OAuth error-redirect walks the browser through legitimate Microsoft or Google endpoints before it lands on the proxy ^[9], which relays credentials and MFA codes to Microsoft in real time ^[11]. The asset freezes in South Africa, Argentina and Romania ^[17] take money off operators, but that $320 price tag holds steady regardless.

Indicators in the write-up are thin and perishable: .vu landing pages, alternating-case subdomains such as PwPt-sHaRe ^[11]. The session is where this is catchable, which is why the analysts quoted place the browser at the intersection of the hops ^[19]. TeamPCP shows the residue of the other approach. The AFP has charged two people over principal roles, while the credentials taken through backdoored Trivy, Checkmarx KICS and LiteLLM releases number in the hundreds of thousands ^[6], a stockpile the arrest leaves untouched.

All five actions come from one weekly roundup that supplies no dates, case numbers or domain lists ^[15]. That applies equally to the Treasury figures: five Mabna Institute members and close to 60 Iran-linked entities sanctioned under Economic Outcast, with indictments and a $10 million reward ^[5]. Whether any of it changed a specific network's exposure is answerable only in that network's logs, and only once the seized names are public.