DOJ seizes QScan and QTRouter: somebody else's camera was the return address

The division of labour between the two seized products is the part worth reading twice. QScan handled acquisition, scanning the internet and automatically infecting IoT devices, according to the Justice Department ^[5]. QTRouter handled use: an obfuscation network that made activity appear to come from any of those infected devices ^[6]. A home router in a third country therefore shows up twice in the same operation, once as a victim and once as the apparent origin of an intrusion against someone it has never heard of ^[17].

FBI Assistant Director Brett Leatherman described the scanning platform as scouring the internet for vulnerable smart devices such as home routers and security cameras, infecting thousands of them and feeding them into a botnet ^[7], and said the group exploited devices in more than 130 countries ^[16]. The named victims, by contrast, are American: the Federal Reserve, the Department of Energy, the DOJ itself, the Senate and NASA, plus HHS, NIH, hospitals, telecommunications providers, power companies, financial institutions and defence contractors ^[4]. The two populations barely overlap ^[19]. Most owners of the exploited devices were never targets. They were plant.

The DOJ says the tools let operators make attacks look as though they came from other countries, and in some cases as though the incidents were caused by local attackers ^[9]. For anyone who has triaged an incident since 2018 ^[1], that second outcome is the expensive one. A misread of nationality is bad; a misread that says "this came from inside our own market" routes the case to the wrong team, the wrong legal theory and the wrong disclosure obligations.

Against that, the earliest case in the affidavit does not fit the pattern. In the 2019 NASA incident, one of the first the FBI investigated, attackers tried to exploit a Pulse Secure VPN flaw and investigators traced the IP addresses back to locations and email addresses in China ^[15]. So the laundering was not applied everywhere, or it leaked. Attribution held in that instance, which is a caution in both directions: a relay service existing does not mean every operation ran through it.

The FBI also says the group operated inside a network of hackers-for-hire and government clients in China ^[10] and had unspecified customers outside the Chinese government ^[11]. Relay infrastructure with unnamed tenants means an infected device may have carried traffic for parties the affidavit does not identify.

The takedown itself was cheap because the design was brittle: the seized domains were hard-coded into both platforms for essential tasks including communication and authentication, which rendered them inoperable ^[8]. The account describes no court-authorised removal of implants from devices this time, though the FBI has done exactly that before, pulling PlugX off thousands of US computers last year and disrupting the Volt Typhoon and Flax Typhoon botnets in 2024 ^[12][18]. Domains die; implants stay where they are. The DOJ also did not respond to questions, and the affidavit does not say which senators or committees were hit ^[13].