Officials disrupt Chinese espionage operation that hit multiple federal agencies

Federal authorities disclosed and disrupted a China state-sponsored espionage campaign dubbed QTFY that targeted and compromised U.S. critical infrastructure and multiple federal agencies since 2018; investigators seized domains used to run QScan and QTRouter, tools that performed large-scale reconnaissance, exploitation (including Ivanti zero-days), IoT botnet operations, and traffic concealment. The takedown prevented further access to the group’s infrastructure, and U.S. agencies released a joint advisory with known indicators of compromise and details of the intrusions.