The DOJ and FBI seized QScan and QTRouter, platforms run by China state-sponsored hackers to hide attacks on U.S. critical infrastructure.
Related Posts:
TeamPCP Hackers Arrested in Joint Operation
SilkParasite APT Hits Central Asian Governments With 7 RATs
Operation CameraSwarm: 14,500 Dahua Cameras Compromised Across Ukraine and Russia
The post FBI Seizes QScan and QTRouter Platforms Run by China State Hackers appeared first on Daily CyberSecurity.
FBI seizes QScan and QTRouter, China-linked platforms used to hide intrusions and target U.S. critical infrastructure.
The U.S. Department of Justice and the FBI have seized two platforms, QScan and QTRouter, used by a China-linked group to hide cyberattacks and target critical infrastructure. The operation matters because it shows how state-backed actors no longer need to build every part of an attack from scratch: they can rely on shared scanning tools, compromised devices, commercial prox
FBI seizes QScan and QTRouter, China-linked platforms used to hide intrusions and target U.S. critical infrastructure.
The U.S. Department of Justice and the FBI have seized two platforms, QScan and QTRouter, used by a China-linked group to hide cyberattacks and target critical infrastructure. The operation matters because it shows how state-backed actors no longer need to build every part of an attack from scratch: they can rely on shared scanning tools, compromised devices, commercial proxy services, and rented servers.
U.S. authorities attribute the activity to a group known as QTFY, which they say operated through the China-based company Nanjing Xinjiuwei Network Technology Company. According to the Justice Department, the group offered hacking services to paying clients that included China’s Ministry of State Security and the People’s Liberation Army.
“The Justice Department and FBI announced court-authorized domain seizures today to deny malicious cyber actors access to two complementary hacking platforms known as “QScan” and “QTRouter,” used to target U.S. critical infrastructure and other sensitive networks. As described in court documents unsealed in the Southern District of California, a People’s Republic of China (PRC) state-sponsored group known as “QTFY,” employed by China-based Nanjing Xinjiuwei Network Technology Company (南京鑫玖维网络科技有限公司), created and operated QScan and QTRouter.” reads the press release published by DoJ.
According to the Justice Department, QTFY targeted NASA, the Federal Reserve, the Departments of Energy, Justice, and Health and Human Services, the National Institutes of Health, and the U.S. Senate. Those are not random targets caught in a broad scan.
QScan and QTRouter had different jobs. QScan searched the internet for vulnerable devices and automatically infected thousands of exposed Internet of Things devices. Those compromised routers, cameras, appliances, and other connected systems were then added to QTRouter, a proxy network used to route malicious traffic through systems located outside China.
That approach makes attribution and blocking harder. A victim may see an attack coming from what appears to be a local router, a legitimate commercial proxy, or a virtual private server rented in another country. Blocking traffic by country or IP address becomes far less useful when the attacker is borrowing the identity and location of other people’s devices.
“QScan scans and automatically infects thousands of “internet-of-things” (IoT) devices worldwide, which are then added to the QTRouter network of QTFY-controlled devices. QTRouter consists of these compromised IoT devices, as well as commercial proxy service devices and leased virtual private servers.” continues DoJ. “QTRouter then serves as an “obfuscation network” – meaning it allows QTFY and other malicious cyber actors to conceal the PRC-origin of their computer intrusion activities because the malicious communications appear to originate from computers (such as those compromised by QScan) that are outside of the PRC and may even be local to the targeted networks.”
The government did not merely take down a website. The seized domains were hard-coded into QScan and QTRouter and used for core functions such as authentication and command-and-control communication. By taking control of those domains through a court order, the FBI made the malware platforms unable to operate as intended.
This is a useful example of technical disruption rather than simple attribution. Publicly naming a group matters, but it does not stop an operator who already has access to vulnerable devices and a working relay network. Taking away the infrastructure they need to manage that network is more disruptive, at least until they rebuild it.
“Because the seized domains were hard-coded into both the QScan and QTRouter malware and used for essential tasks such as communication and authentication, the court-authorized seizures made QScan and QTRouter inoperable.” DoJ states.
The broader operation looks like an industrial service model. QTFY allegedly used QScan to map targets, identify weaknesses, and compromise devices; it then used QTRouter and other proxy layers to hide where the activity actually came from. Lumen’s Black Lotus Labs described the group as a “digital quartermaster,” meaning it supplied infrastructure and services that could support multiple operations at the same time.
“To support its primary objectives, the quartermaster runs a secondary, completely decoupled target profiling utility called “QScan.” While the core proxy network focuses on managing stateful session paths, the QScan framework operates as the front-end scout.” reads a report published by Lumen. “The operations of this quartermaster demonstrate the high degree of industrialization occurring within China-nexus cyber operations. By shifting away from fragmented, ad hoc setups and toward shared multi-tenant utility networks, state-sponsored actors can execute complex campaigns with a high degree of anonymity and speed, and at a global scale.”
The group reportedly exploited both old and newly disclosed vulnerabilities in widely deployed products, including Fortinet SSL-VPN, Citrix ADC, Microsoft Exchange, F5 BIG-IP, Apache Log4j, Atlassian Confluence, Check Point gateways, CrushFTP, Ivanti appliances, and BeyondTrust Remote Support. This is not a reminder that organisations need magic detection. It is a reminder that old vulnerabilities remain useful because somebody, somewhere, will still leave them unpatched.
The attack chain also included web shells, remote-access trojans, stolen or legitimate credentials, and compromised IoT devices used as nearby relay points. That combination allows an attacker to blend into normal-looking traffic and avoids the obvious infrastructure that defenders have learned to block. A hostile connection that looks like a local consumer router is still hostile; it just has better camouflage.
This seizure follows earlier FBI actions against China-linked botnets. In 2025, the FBI removed PlugX malware from more than 4,000 infected U.S. computers linked to Mustang Panda. In 2024, it disrupted a botnet of hundreds of thousands of IoT devices associated with Flax Typhoon, while in 2023 it acted against a Volt Typhoon botnet used to conceal activity targeting U.S. and foreign critical infrastructure.
“For defenders, the operational lesson is straightforward. Inventory internet-facing assets, patch known vulnerabilities quickly, remove unsupported devices, monitor unusual outbound proxy traffic, and do not assume that an IP address tells you who is behind an attack. The same applies to IoT equipment: a router, camera, network appliance, or smart device left exposed and unmanaged can become part of someone else’s attack platform.
“This disruption announced today is among a series of court-authorized technical operations against indiscriminate hacking activities by the PRC.” concludes DoJ.
Stripe reportedly nears a massive $7 billion deal to acquire AI startup OpenRouter. Discover how this massive API hub transforms the artificial intelligence landscape.
Related Posts:
Anthropic Revenue Surges 14x to $11.5B in Q2 2026 Ahead of IPO
SpaceX Acquires AI Coding Startup Cursor
Qualcomm Snapdragon C Targets $300 Windows Laptops to Rival MacBook Neo
The post Stripe Finalizes $7 Billion Acquisition of OpenRouter appeared first on Daily CyberSecurity.
Stripe reportedly nears a massive $7 billion deal to acquire AI startup OpenRouter. Discover how this massive API hub transforms the artificial intelligence landscape.
Unit 42 research examines attack scenarios targeting cloud logging services. Learn how to defend against log manipulation and defense evasion.
The post Blinding the Watchmen: Abusing Cloud Logging Services for Defense Evasion and Visibility appeared first on Unit 42.
The rise of SOHO router compromise campaigns has exposed a critical weakness in global network security, particularly as threat actors like Forest Blizzard continue to exploit poorly secured home and small-office devices.
According to security researchers, this Russia-linked group has been systematically targeting vulnerable routers since at least August 2025, transforming them into covert infrastructure for surveillance and follow-on cyberattacks.
Forest Blizzard and the Expanding SOHO
The rise of SOHO router compromise campaigns has exposed a critical weakness in global network security, particularly as threat actors like Forest Blizzard continue to exploit poorly secured home and small-office devices. According to security researchers, this Russia-linked group has been systematically targeting vulnerable routers since at least August 2025, transforming them into covert infrastructure for surveillance and follow-on cyberattacks.
Forest Blizzard and the Expanding SOHO Router Compromise Campaign
Forest Blizzard, a threat actor associated with Russian military intelligence and tracked in part as Storm-2754, has conducted widespread exploitation of SOHO devices. By leveraging the SOHO router compromise, the group has successfully hijacked Domain Name System (DNS) requests, allowing it to passively monitor and collect network traffic at scale.Microsoft identified more than 200 organizations and over 5,000 consumer devices impacted by this malicious DNS infrastructure. Notably, telemetry showed no compromise of Microsoft-owned systems. However, the breadth of affected networks highlights the campaign’s reach and the effectiveness of targeting edge devices that often lack strong monitoring or security controls.For actors like Forest Blizzard, DNS hijacking provides persistent and low-visibility access to sensitive data flows. By positioning themselves upstream of enterprise environments, attackers can observe and potentially manipulate traffic without directly breaching corporate systems.
How SOHO Router Compromise Leads to DNS Hijacking
After gaining access to vulnerable routers, Forest Blizzard alters their default configurations to use attacker-controlled DNS resolvers. This manipulation causes connected devices to unknowingly send DNS queries to malicious servers.Most endpoint devices rely on routers for network configuration via the Dynamic Host Configuration Protocol (DHCP). Once a router is compromised, all connected devices inherit the malicious DNS settings. This makes the SOHO router a compromise, an efficient and scalable attack vector.The group is believed to use the legitimate dnsmasq utility to handle DNS queries. While dnsmasq is commonly used in home networking for DNS forwarding and DHCP services, in this context, it enables attackers to intercept, log, and respond to DNS requests while maintaining the appearance of normal operations.
Forest Blizzard’s Use of Adversary-in-the-Middle Attacks
Beyond passive surveillance, Forest Blizzard has extended its SOHO router compromise operations to support adversary-in-the-middle (AiTM) attacks. These attacks specifically target Transport Layer Security (TLS) connections, enabling interception of sensitive communications.In most cases, DNS traffic is transparently proxied, allowing users to connect to legitimate services without disruption. However, in select high-value scenarios, the attackers spoof DNS responses for targeted domains. This redirects victims to malicious infrastructure controlled by Forest Blizzard.Once redirected, victims may encounter invalid TLS certificates mimicking legitimate services such as Outlook on the web. If users ignore certificate warnings, attackers can intercept plaintext data within the encrypted session. This may include emails and other sensitive cloud-hosted content.Researchers observed two notable AiTM scenarios:
Attacks on Microsoft 365 domains, particularly Outlook on the web.
Targeted operations against government servers in at least three African countries, where DNS interception enabled further data collection.
Mitigation Strategies Against Forest Blizzard Threats
To counter risks associated with SOHO router compromise, researchers recommend several defensive measures. For DNS protection, organizations should enforce domain-based access controls using Zero Trust DNS (ZTDNS), block malicious domains, and maintain detailed DNS logs to detect anomalies. Enabling network and web protection features in Microsoft Defender for Endpoint further strengthens defenses.Equally critical is addressing identity security. Centralizing identity management, enforcing multifactor authentication (MFA), and applying Conditional Access policies can reduce the impact of credential theft from AiTM attacks. It is also advised to adopt passwordless solutions such as passkeys and restrict authentication to trusted devices and locations.
Misconfigurations remain a popular compromise point — and routers are leading the way.
According to recent survey data, 86% of respondents have never changed their router admin password, and 52% have never adjusted any factory settings. This puts attackers in the perfect position to compromise enterprise networks. Why put the time and effort into creating phishing emails and stealing staff data when supposedly secure devices can be accessed using “admin” and “password” as credentials?
It’s time
Misconfigurations remain a popular compromise point — and routers are leading the way.
According to recent survey data, 86% of respondents have never changed their router admin password, and 52% have never adjusted any factory settings. This puts attackers in the perfect position to compromise enterprise networks. Why put the time and effort into creating phishing emails and stealing staff data when supposedly secure devices can be accessed using “admin” and “password” as credentials?
It’s time for a router reality check.
Rising router risks
Routers allow multiple devices to use the same internet connection. They accomplish this goal by directing traffic — internal devices are routed along the most efficient path to outside-facing services, and incoming data is sent to the appropriate endpoint.
If attackers manage to compromise routers, they can control both what comes out of and what goes into your network. This introduces risks such as:
The nature of router attacks also makes them hard to detect. This is because cyber criminals aren’t forcing their way into routers or taking circuitous routes to evade security defenses. Instead, they’re taking advantage of overlooked weak spots to access routers directly, which means they aren’t raising red flags.
Consider a router with “admin” as the login and no password. A few simple guesses get attackers into router settings without triggering a security response since they haven’t breached a network service or compromised an application. Instead, they’ve accessed routers the same way as staff and IT teams.
Companies recognize the need for robust cybersecurity. According to Gartner, spending on information security will grow 15% in 2025 to reach $212 billion. Common investment areas include endpoint protection platforms (EPPs), endpoint detection and response (EDR) and the integration of generative AI (gen AI). Routers, however, are often overlooked.
For example, 89% of respondents have never updated their router firmware. The same number have never changed their default network name, and 72% have never changed their Wi-Fi password.
This is problematic. A recent report found that popular OT/IoT router firmware images were outdated and contained exploitable N-day vulnerabilities. The report found that, on average, open-source components were more than five years old and were four years behind the latest release.
As noted by GovTech, meanwhile, an attack on a Pittsburgh-area water authority succeeded in part because the default password to its network was “1111”. Other common passwords include “password” and “123456;” in some cases, routers have no passwords. All attackers need is the login credential — which is often “admin” — and they have full access to router functions.
Even more telling is the fact that router security is getting worse, not better. Consider that in 2022, 48% of respondents said they had not adjusted their router settings, and 16% had never changed the admin password. In 2024, over 50% of routers were still running on factory settings, and just 14% had changed their password.
By spending more on security tools but not changing default configurations or updating router firmware, businesses are closing the doors but leaving the windows wide open.
Minimizing misconfiguration mistakes
So, how do companies minimize the risk of misconfiguration mistakes?
It starts with the basics: Change passwords regularly, update firmware and ensure that routers aren’t left on factory settings. Simple? Absolutely. Common? As survey data indicates, not so much.
In part, the disconnect between router risks and security realities stems from the sheer volume of cyberattacks. For example, 2023 saw 94% of companies hit by phishing attacks, and as noted by the IBM Cost of a Data Breach Report 2024, the average cost of a data breach is now $4.88 million, up 10% from 2023 and the highest ever reported. This puts cybersecurity teams on the defensive and on high alert for common attack vectors such as phishing, smishing and the use of “shadow IT” applications that haven’t been vetted or approved.
As a result, routers can slip through the cracks. The first step in solving this problem is creating a regular update schedule. Every four to six months, schedule a router review — put it in a shared calendar, and make sure all security staff know it’s going to happen. When the designated day comes, update firmware where possible and change login and password details. It’s also worth establishing a weekly schedule to review router traffic for any odd behaviors or unexpected login requests.
Shoring up security
While basic cyber hygiene helps lower the risk of router attacks, shoring up security requires a more in-depth approach.
The first step is finding and securing every router on your network. Given the increasingly complex nature of enterprise networks, the easiest way to accomplish this goal is by using automation. Solutions such as IBM SevOne Automated Network Observability provide pre-built workflow templates for IT teams to identify connected devices, collect performance data and make data-driven decisions.
Companies also need to consider what happens when a router compromise occurs. Despite best efforts by security teams, the growing number of end points means it’s only a matter of time until attackers manage to find unprotected routers or circumvent existing defenses.
Effective response requires effective incident management. Solutions such as IBM Instana offer full-stack visibility, one-second granularity and three seconds to notify, giving teams the information they need when they need it to reduce security risks.
Bottom line? Failure to monitor and update router settings can open the door to compromise. To solve the problem, teams need a router reality check. By combining security hygiene best practices with intelligent automation solutions, enterprises can keep unauthorized users where they belong: 0utside protected networks.
The rising risk of router attacks, paired with a growing list of unreasonable expectations, creates complex challenges for security teams. The solution? Unreasonable observability. Learn more on IBM Instana and how it can help.
Entrar
