← whack.sh News

The FBI QTFY Advisory: When Attackers Rent the Same Proxies You Do

2026-08-27 · Threat Advisory

On August 26th the FBI, NSA and US Cyber National Mission Force published joint advisory JCSA-20260826-01 on a China-linked group tracked as QTFY. It is marked TLP:CLEAR and is freely available in full. Everything attributed below is the advisory's finding, not ours — we are reporting on a public government document, and we did not independently verify its attribution.

We are writing about it because one detail in it speaks directly to how URL scanning works, and because we checked our own data against it and found nothing. Both halves are worth saying.

A threat actor structured as a product company

The advisory attributes QTFY to Nanjing Xinjiuwei Network Technology Co. (XJW), founded in 2018 and described as a PRC "enabling company" with business relationships to Ministry of State Security units, with personnel including former PLA members. It reports the company operating commercially — buying and selling exploits and network access inside Chinese freelance hacking markets — while targeting the US defense industrial base, telecommunications, energy, financial institutions, universities and local government.

What makes the document unusual is not the targeting. It is that the advisory documents three branded internal platforms, with administration interfaces, working together:

  • QScan — distributed scanning and exploitation. RabbitMQ task queues feed worker nodes on leased servers outside China, with Redis holding results. The advisory says it carries more than 200 Python proof-of-concept exploits, and that on a single day in 2024 it processed over two million scanning and pentest tasks. Task types include webpage scraping, TLS certificate collection, subdomain enumeration and CMS plugin detection.
  • QTRouter — a traffic obfuscation network built on routers running custom OpenWrt, using Clash for proxy chaining, administered through a "Proxy Node Management System" (代理节点管理系统).
  • Botnet management — three platforms, including a "Proxy Pool Management System" holding a database of exploits alongside server fingerprints, so operators can identify matching targets the moment a new exploit lands. Compromised device categories include SOCKS5 proxies, MikroTik RouterOS and PPTP endpoints.

The advisory names twelve CVEs: CVE-2019-10068, CVE-2019-11510, CVE-2019-19781, CVE-2020-5902, CVE-2021-44228 (Log4Shell), CVE-2023-22515, CVE-2024-8190, CVE-2024-8963, CVE-2024-9380, CVE-2024-24919, CVE-2025-31161 and CVE-2026-1731. It also records that QTFY used Ivanti CSA zero-days in September 2024 immediately after participating on the offensive side of Chinese national cyber-defense exercises (护网 / HW / HVV), and that the group has been "heavily researching and integrating AI into their processes over the last two years."

The part we can actually speak to: shared exit nodes

QTRouter's node pool, per the advisory, is a mix of commercial proxy service IPs, Alibaba Cloud addresses, and compromised IoT devices.

That first category is the one worth sitting with. The design goal is to make operator traffic indistinguishable from ordinary consumer traffic — and the way it achieves that is by renting the same commercial residential proxy pools that everybody else rents, padded out with compromised home routers.

That is the same class of infrastructure legitimate security scanning runs on. It is the same class of infrastructure we run on: seeing what a residential visitor is served, rather than what a datacenter IP is served, requires egressing from residential space, and there is a finite supply of it.

The defensive implication is not "block these ranges." An address that carried a state-linked scan last month may carry a security vendor's check today and a real customer's shopping session tonight — and nothing about the address itself announces which.

The tempting conclusion is that IP intelligence is therefore a dead end. It is not. What this argues against is static reputation: a stored verdict that an address is good or bad. Verdicts age, and on shared infrastructure they age in days.

The facts underneath do not age the same way, because they are observations rather than judgements. Who announces this prefix. What ASN it belongs to. Whether it is datacenter, residential or a known proxy pool. What its reverse DNS says today, and whether that forward-confirms. Those are answerable questions, and the answers are genuinely useful for weighting a session — but only while they are current. An address reassigned last week has a different meaning than the one your database recorded last year, and the record will not tell you that unless it was re-measured.

So the requirement the QTFY advisory implies is not a bigger blocklist. It is a shorter refresh interval. If the population of a proxy pool turns over in days, intelligence about that pool has to be measured in hours to mean anything. This is the reasoning behind how we built WorldIP: the full allocated IPv4 space — 3.69 billion addresses — rescanned in under 24 hours, with reverse and forward DNS re-measured on the same cycle rather than cached indefinitely.

None of which removes the need to look at behavior. A current, accurate profile of an address tells you what you are talking to; it does not tell you what it is doing. Both matter. But the half of the problem that is tractable with data is the half that decays, and decay is fixable by measuring more often.

What we checked, and what we found

The advisory ships 435 indicators. We cross-referenced all of them against our own records:

  • 0 of 45 file hashes match anything we have ever captured
  • 0 of 45 domains appear in our scan records or resource logs
  • 0 of 345 IPs appear in our scan records
  • 2 of 345 IPs appear in our intel queue, both sourced independently from ThreatFox rather than from us

Of those two: 23.95.220.192, listed in the advisory as Proxy Platform Management infrastructure, we scanned on 2026-07-05 and found unreachable — roughly seven weeks after the FBI's own last-seen date for it. The other, 193.160.32.138, is being flagged by ThreatFox at the time of writing, but the advisory's window for it closed in March 2021. Current activity there is far more likely a re-leased address than live QTFY infrastructure.

A null result is not a clean bill of health, and we are not presenting it as one. It does not mean QTFY is inactive, and it certainly does not mean the advisory overstates anything. It means our collection surface — malicious URLs and payloads reachable from public feeds — does not overlap with targeted intrusion infrastructure. Those are different problems with different visibility. A scanner that follows publicly-reported malicious links is not positioned to see a contractor quietly enumerating subdomains at a defense supplier, and it would be dishonest to imply otherwise.

We publish the null anyway, because "we looked and found nothing" is a result, and because the alternative — quietly saying nothing when the answer is boring — is how threat intelligence acquires a reputation for only ever reporting hits.

The caveat that matters more than the indicator list

Several indicators in this advisory trace to activity as early as 2017, and the agencies explicitly recommend vetting the addresses before blocking them. That guidance deserves more attention than it usually gets.

An IOC list is a research starting point with a shelf life, not a blocklist. Addresses get re-leased. Hosting providers reassign ranges. Compromised routers get replaced or cleaned. The 193.160.32.138 case above is exactly this shape: an address with genuine current reporting against it, and a five-year gap between that reporting and the activity the advisory documented.

Blocking a stale indicator costs you a false positive against whoever holds the address now. Treating it as a lead — checking what that address is doing today, from your own vantage — costs you nothing and occasionally finds something real.

The full advisory is at ic3.gov, and the agencies publish the indicators as two CSVs:

Those first-seen and last-seen columns are the most useful thing in the release and the part most likely to be dropped when a list gets copied around. Keep them. An indicator without a date range cannot be vetted, and vetting is what the agencies asked for.

We have deliberately not reproduced the 435 indicators here. The authoritative copies belong with the agencies that can update them.