Source advisory: FBI | NSA | Cyber National Mission Force Joint Cybersecurity Advisory, August 26, 2026
Key Takeaways
- QTFY operates at scale. Its reconnaissance, exploitation and proxy infrastructure creates an attack ecosystem – not a series of isolated actions.
- AI compresses the defender’s response window. Automation can make established tactics faster, broader and more efficient even when the underlying techniques are familiar.
- Advisory guidance needs to become test cases. Teams should validate whether their controls detect active scanning, multi-hop proxies, web shells, remote-access tools and stolen credentials.
- Coverage on paper is not proof of readiness. Detection and response capabilities must be exercised against the specific behaviors described in the advisory.
- Cyber readiness includes operational resilience. Organizations need to know what can be isolated, what must remain available, and what should be recovered first.
The Joint Cybersecurity Advisory from the FBI, NSA, and Cyber National Mission Force, released August 26, describes a China-linked hacking group known as QTFY. The group has been targeting critical infrastructure and sensitive organizations across defense, communications, government, energy, higher education, and water. But what stands out is not just who they are targeting, but how they are operating.
QTFY has essentially built an attack ecosystem.
One component, QScan, performs large-scale reconnaissance and exploitation with more than 200 proof-of-concept exploits and processed more than two million scanning and penetration-testing tasks in a single day in 2024. Another component, QTRouter, routes traffic through commercial proxy services and compromised IoT devices to help obscure the origin of malicious activity.
QTFY also exploits both zero-day and known vulnerabilities; uses remote-access trojans, web shells, and stolen credentials for persistence; and has been researching and integrating AI into its operations over the past two years.
AI does not magically create a new cyber threat category, but it can make an existing operation faster, more scalable, and more efficient. Combined with years of reconnaissance data, exploit libraries, and traffic-obfuscation infrastructure, the window for defenders to react shrinks.
From Guidance to Test Cases
Especially important is the advisory’s “Validate Security Controls” section. What follows translates that guidance into specific test cases for a QTFY-style intrusion.
QScan’s reconnaissance maps to MITRE ATT&CK technique T1595, Active Scanning. Given the scale at which QScan operates, the question for defenders is whether controls can recognize automated reconnaissance targeting your environment amid normal internet traffic, and whether that capability has actually been tested.
QTRouter’s use of commercial proxies and compromised IoT devices aligns with MITRE ATT&CK T1090, Proxy, particularly T1090.003, Multi-hop Proxy. On the persistence side, the advisory maps web shells to T1505.003, and uses remote-access trojans (T1219) and stolen credentials (T1078, Valid Accounts) to maintain access.
QTFY’s use of stolen credentials is worth calling out separately. T1078, Valid Accounts, sits in a blind spot for most security programs because legitimate credentials tend not to trip traditional malware detection.
Each of those mappings raises a practical testing question. Can your team detect a web shell sitting on a server you believe is patched and monitored? Can you recognize traffic being deliberately routed through multiple proxies and compromised IoT infrastructure? Testing those controls is different from simply confirming the patch was installed.
That testing discipline must extend into resilience. No security program can guarantee that every attack will be stopped, so organizations must prepare for the moment when something gets through: what has to stay operating, what recovers first, and how quickly. In short: what can actually be isolated, and for how long, before the business itself feels it?
For a deeper look at that operating model, see ResOps: The Future of Resilient Business in the Era of AI. This piece is about what QTFY specifically demands of your testing program.
Pick one QTFY technique above and test it against your own controls. That is what tells you whether readiness is real.
FAQs
Q: What is QTFY?
A: QTFY is a China-linked hacking group described in the joint advisory as targeting critical infrastructure and other sensitive organizations. Its activity combines large-scale reconnaissance, exploitation, traffic-obfuscation infrastructure, and persistence techniques.
Q: Why is the advisory a readiness test?
A: The advisory describes concrete attacker behaviors that organizations can reproduce safely in controlled exercises. Testing those behaviors shows whether controls work in practice and whether response decisions can be made quickly.
Q: Which QTFY techniques should teams test first?
A: Start with the behavior that poses the greatest risk or has the least-tested coverage in your environment. Examples include active scanning, proxy-based traffic obfuscation, web-shell persistence, remote-access tools, and the use of valid but stolen credentials.
Q: Is patching enough to address the threat?
A: No. Patching known vulnerabilities is essential, but QTFY also uses zero-days, stolen credentials, and persistence mechanisms. Organizations need layered detection, segmentation, identity controls, threat hunting, and tested response procedures.
Q: How does AI change the threat?
A: AI does not necessarily introduce a new class of attack. It can help an established operation analyze data, automate tasks, and scale activity faster, leaving defenders less time to detect and contain an intrusion.
Q: What should an organization do next?
A: Review the advisory, address urgent exposure, and choose one relevant technique for a controlled validation exercise. Define the expected alert, response owner, isolation decision, and recovery priority before running the test, then close any gaps the exercise reveals.
Chris Bevil is Principal Portfolio Marketing Manager at Commvault.