Tech · FBI seizes global botnetFBI Seizes Botnet That Routed China Attacks Through 130 CountriesAired August 27, 2026 at 5:44 PM UTCWritten September 7, 2026 at 9:22 PM UTCRead the write-upThis storyTranscript · LOADING0:00A global botnet that hit attacks inside home routers just went dead.0:04For nearly a decade, it turned thousands of everyday cameras and routers into cover,0:08routing intrusions through more than 130 countries so attacks on hospitals, power0:12companies, telecom providers, and federal agencies looked local.0:16On August 26th, that cover was cut when three hard-coded domains were seized and two0:21platforms went inoperable.0:22The question now is whether losing those domains permanently blinds the network or0:26leaves thousands of still-infected devices ready to be rebuilt.0:29QTFY is also called QT, QTCWIBER and Quantum Typhoon.0:35Attributed to Nanjing Xinjue Network Technology Co.0:38established in 2018, the company employs former People's Liberation Army members who0:43leverage military relationships for contracts, sells hacking services to the0:47Ministry of State Security and the People's Liberation Army, and trades exploits and0:51access in China-based freelance networks with ties to entities linked to SALT0:55Typhoon and iSoon.0:56QScan is the reconnaissance layer scanning the entire IPv4 space on those five1:00ports.1:01grabbing banners to identify firmware and firing from a library of more than 2001:05attacks.1:06On one day in 2024, it processed more than 2 million scanning or exploitation tasks.1:11Qtrouder is the obfuscation layer, custom OpenWRT firmware that keeps a dynamic1:16inventory of proxy nodes including compromised IoT devices, commercial proxy devices1:20and leased virtual private servers, then chains encrypted hops.1:24Later variants hijacked VPN services used to bypass the great firewall so malicious1:28traffic blended with legitimate VPN traffic.1:31At least three related management platforms exist: Proxy Platform Management, Proxy1:36Pool Management System, and Qt Botnet.1:38Concealment was structural.1:39Attack traffic was routed through infected devices in more than 130 countries, with1:44thousands of devices enrolled globally.1:46By appearing to originate outside the People's Republic of China and potentially1:49local to the target, it blended with legitimate traffic and made attribution and1:53blocking far harder.1:54On one day in 2024 alone, QScan processed more than 2 million scanning or1:59exploitation tasks using code for more than 200 attacks.2:03That traffic was bounced through compromised devices in more than 130 countries.2:08Thousands of routers and cameras worldwide rented alongside commercial proxies and2:12virtual private servers.2:13The timeline runs from at least 2018, nearly a decade.2:17After early scanning of energy department networks in May 2018 and the 2019 Pulse2:21Secure VPN exploitation against the Justice Department, Federal Reserve, and NASA,2:25the pace accelerated.2:27In May 2024, a checkpoint quantum gateway vulnerability was hit shortly after public2:31disclosure, with server settings, configuration files, and user credentials2:34exfiltrated from more than 300 U.S.2:36organizations, including defense contractors, financial institutions, and2:40universities.2:41In September 2024, zero days and Ivanti Cloud Services appliance were used to2:45intrude at three Department of Energy laboratories, the National Institutes of2:49Health, an HHS agency, and a U.S.-based security device manufacturer, intrusions2:53that use the same domains that were just seized.2:55The seizure was a court-authorized technical operation, not an arrest action.2:59Because the domains were hard-coded into both QScan and Q-Trouter binaries, cutting3:04them denied access and made the platforms inoperable.3:07But it did not clean the routers and cameras already compromised, and rebuilding3:11with new domains remains possible.3:13Officials noted this follows earlier technical operations against PRC-sponsored3:18infrastructure, Volt Typhoon botnet in 2023, Flax Typhoon botnet of hundreds of3:23thousands of IoT devices in 2024, and removal of PlugX malware from more than 4,0003:28U.S.3:29computers infected by Mustang Panda in 2025.3:32A 36-page joint cybersecurity advisory from the FBI, National Security Agency, and3:37Cyber National Mission Force went out the same day, August 26, listed as IC33:422026-260826 and marked TLPTH Clear, with downloadable indicators of compromised3:48files for files and infrastructure and MITRE-ATSC mappings dating back to at least3:522018.3:53It tells organizations to patch and update firmware and software immediately and3:57enable automatic updates where possible, audit internet-facing pages and4:01applications so operational information is not exposed to crawlers.4:04Isolate critical systems from edge devices through zero-trust segmentation and hunt4:09for the published indicators.4:10Lumen Technologies Black Lotus Labs separately published tactics, techniques, and4:15procedures.4:15FBI Director Cash Patel said the tools were used by PRC cyber actors to hide the4:21origin of their attacks and that the disruption targeted a global botnet and hacking4:25platform used to target U.S.4:27critical infrastructure.4:34Warnings place QTFY at the center of sensitive networks, aggressively targeting the4:39U.S.4:39military and NASA, the defense industrial base, communications, government, and4:43higher education, with products that enabled targeting of hospitals,4:47telecommunications providers, power companies, financial institutions, and defense4:51contractors.4:52Named victims of computer intrusion activity include NASA, the Federal Reserve, the4:56Justice Department, the U.S.4:58Senate, the Department of Health and Human Services, the National Institutes of5:02Health, and Department of Energy Laboratories.5:04But the Justice Department has not detailed damage and whether intrusions led to5:08persistent access, broader data theft, or operational effects, including from5:13military and defense industrial-based networks, remains unresolved.5:17The three energy laboratories hit in September 2024 have not been named5:21individually, and the full scope beyond server settings and credentials for the5:24300-plus organizations hit in May 2024 has not been enumerated.5:28The seizure exploits a hard-coded weakness to make Q-Scan and Q-Trotter inoperable,5:33but thousands of devices in more than 130 countries remain compromised, and5:37alternative control channels could persist.5:39Whether inoperability holds without follow-on rebuilds will determine if this is a5:43lasting denial for an eight-year enablement provider whose customers include5:46intelligence and military services or a temporary pause.Explore with HeyDexThe shortThe short ↗