DOJ takedown puts hijacked cameras and routers on the critical-path asset inventory

The seizure worked because of a build defect on the attacker's side. qtproxy.xyz, qt-proxy.org and qt-team.com were hard-coded into both QScan and QTRouter, and the malware needed them for communication and authentication, so removing the domains left both tools inoperable ^[14][15]. That is a coding choice, not a capability loss, and the Justice Department's own wording is that the crackdown "should free" the affected IoT devices ^[19], a forecast about hardware nobody has inspected.

The throughput is the number worth keeping. On a single day in 2024, according to the FBI, QScan processed over two million scanning and penetration testing tasks ^[9], which works out to roughly 23 per second sustained across the full 24 hours ^[18]. The library behind it held more than 200 proof-of-concept exploits written in Python and was described as designed for large-scale employment ^[8]. None of that is research. It is a sweep of known holes at industrial volume, and it explains the target selection: cheap network hardware is abundant, findable and unowned.

The devices were transport. QTRouter mixed the infected hardware with commercial proxies and virtual private servers to conceal that the operators were in China, routing traffic through a rotating set of addresses ^[10][11]. Routers, security cameras and smart appliances end up on the critical path ^[4] not because anything valuable sits on them, but because the address in front of a federal service has to look ordinary.

What survives a domain seizure is the org chart. The affidavit says QTFY includes former People's Liberation Army members who use those relationships to obtain contracts and subcontracts supporting offensive cyber operations ^[5]. Federal agents say a Chinese company, Nanjing Xinjiuwei Network Technology Company, employs the group and has business relationships with the Ministry of State Security ^[6], and investigators say QTFY sold its hacking services to paying customers including the MSS and the PLA ^[12]. A contractor with a customer list treats three lost domains as a cost of doing business. The FBI's 36-page advisory, with indicators of compromise and a target list running through defense, telecommunications and higher education ^[16], is the part of this that outlives the takedown.