# The FBI Just Ripped Out China's Router-Hop Network. Here's What QScan and QTRouter Were Actually Doing.
When the Justice Department announced Wednesday's disruption of two Chinese hacking platforms, the headline was predictable: another takedown, another attribution to Beijing. What got less attention was the specific infrastructure at the center of it — a pair of tools called QScan and QTRouter that, taken together, paint a clear picture of how China's state-sponsored hackers have been quietly threading their way through U.S. critical infrastructure networks.
The operation targeted QTFY, a threat group employed by Nanjing Xinjiuwei Network Technology Company — another private Chinese contractor acting as a cutout for state intelligence work. If that arrangement sounds familiar, it should.
## The Contractor Model, Again
China's approach to offensive cyber operations has evolved into something the intelligence community now recognizes as a feature, not a bug: outsource the hacking to private companies, maintain deniability, and keep the best talent close enough to direct without putting uniformed operators on the line. We saw this with APT40 and Hainan Xiandun Technology Company, exposed by the DOJ in 2021. We saw it again with the indictments targeting I-Soon (Anxun Information Technology) earlier this year, where leaked documents showed a Chengdu contractor running operations at the direction of the Ministry of Public Security.
Nanjing Xinjiuwei fits the same mold. A registered company, likely with legitimate business activity on the surface, providing cover for what amounts to a signals intelligence operation against American networks.
## What the Tools Were Built For
The two platforms — QScan and QTRouter — aren't random malware. Their names telegraph their roles with unusual clarity.
QScan is a reconnaissance platform. Think of it as a structured, scalable way to survey large swaths of network topology — identifying exposed services, mapping internal assets once initial access is established, and feeding that intelligence back to operators who can decide where to pivot. This isn't the noisy port-scanning of script kiddies; state-linked groups build these tools to be quiet, persistent, and systematic.
QTRouter is the infrastructure that makes attribution hard. By routing traffic through compromised intermediary systems — often small office and home office routers, as we've seen repeatedly with Volt Typhoon — operators can disguise the origin of their intrusions. The packets touching a target network don't trace back to China; they trace back to a plumber's office in Cleveland or a dental clinic in Sacramento.
Together, they represent a complete operational loop: find the target, map the network, move through it via obfuscated routing, and walk out with data.
## Critical Infrastructure, Specifically
The DOJ described targets as "critical infrastructure and other sensitive networks." That language is doing a lot of work. Critical infrastructure in federal parlance spans sixteen sectors — everything from energy and water to transportation, financial services, and healthcare. The QTFY group's specific focus within that space hasn't been fully disclosed, but the tooling tells a story: QScan's systematic approach suggests they were looking for high-value targets with patience, not grabbing opportunistic access.
This matters because the threat posture we're dealing with isn't primarily about espionage anymore — or rather, it's not *only* about espionage. FBI Director Christopher Wray spent much of 2024 publicly warning that Chinese actors had pre-positioned themselves inside U.S. infrastructure for potential disruption, not just data collection. The Volt Typhoon revelations earlier this year made that concrete: dormant access, sitting in power grids and water systems, waiting.
---
## HackWire Analysis
Wednesday's disruption is a win, but the broader picture demands more than a victory lap.
The DOJ-FBI playbook for disrupting state-linked hacking infrastructure has matured considerably since the early days of indicting Chinese nationals who would never face extradition. The QScan/QTRouter takedown follows the operational model first fully deployed against the Volt Typhoon botnet in January 2024 — court-authorized access to compromised infrastructure, bulk credential resets, and neutering the routing nodes that gave operators their anonymity. It works, at least tactically.
What it doesn't do is change the underlying calculus. Nanjing Xinjiuwei employed QTFY. Elsewhere, another contractor is running a different team with different tooling and different internal names. The Chinese offensive cyber ecosystem has enough depth that disrupting one node doesn't reshape the threat landscape — it just forces rotation.
The detail most coverage is glossing over: QTRouter's reliance on compromised SOHO routers is the same technique Volt Typhoon perfected and Salt Typhoon used against U.S. telecom carriers. This isn't coincidence. It's doctrine. The technique works because the defender community has not solved the problem of securing the long tail of small routers — devices bought off Amazon, configured once, and forgotten for six years. Until ISPs and device manufacturers are held to baseline security standards — patching schedules, forced credential resets, remote management disabled by default — this attack surface stays open.
For defenders in critical infrastructure: audit your network perimeter for any legacy SOHO hardware sitting on flat segments. Review routing logs for traffic patterns that hop through residential ISP ranges before hitting your external-facing systems. And treat any reconnaissance activity against OT-adjacent systems as a potential QScan-type probe, because the dwell time between initial mapping and actual impact can be months.
— HackWire Editorial
---
## Related Coverage