China-Linked QTFY Group Targets Critical Infrastructure with Advanced Exploits

The Joint Cybersecurity Advisory JCSA-20260826-01, released on August 26, 2026, details ongoing activities by the China-linked hacking group QTFY, attributed to Nanjing Xinjiuwei Network Technology Co. Active since 2018, QTFY employs platforms like QScan and QTRouter to exploit vulnerabilities in critical infrastructure, including government and defense sectors. The group utilizes a database of over 200 exploits, targeting known vulnerabilities such as Log4Shell (CVE-2021-44228) and several Ivanti and BeyondTrust flaws. Recent operations have led to significant data exfiltration from over 300 organizations globally. The FBI and NSA emphasize the urgency of the threat, advising immediate patching of affected systems. The advisory also warns against blocking unvetted indicators due to potential collateral disruption. QTFY's tactics include using compromised IoT devices as proxy nodes, complicating detection efforts.

Key Points: • QTFY exploits critical vulnerabilities in infrastructure using advanced tools. • Targets include government agencies and critical sectors worldwide. • Immediate patching of affected systems is crucial to mitigate risks.