Notifications
Clear all
Topic starter
28/08/2026 12:03 pm
TL;DR: QTFY is operating less like a hacking crew than an industrial scanning-and-exploitation service, with its platform processing over two million tasks in a single day and routing traffic through obfuscated proxy networks, according to SafeBreach. The defender lesson is clear: public exposure, patch speed, and behavior-based detection matter more than blocklists when internet-facing assets are the entry point.
NHIMG editorial — based on content published by SafeBreach: The Scan Factory: Inside China’s QTFY and the Business of Breaking In
By the numbers:
- QTFY’s platform processed over two million scanning and exploitation tasks in a single day in 2024.
- The FBI, NSA, and Cyber National Mission Force attribute 14 CVEs to QTFY across an eight-year timeline.
- QTFY’s targeting timeline spans 2018 to 2026, showing sustained exploitation of internet-facing systems over eight years.
Questions worth separating out
Q: What breaks when internet-facing services are not tightly governed?
A: Exposed services collapse the gap between discovery and exploitation.
Q: Why does DNS redundancy matter for identity and access programmes?
A: DNS underpins service reachability for SSO, authentication endpoints, SaaS access, and workload connectivity.
Q: How do security teams know whether IOC blocklists are enough against proxy-based attacks?
A: They usually are not. If malicious traffic is relayed through residential proxies, cloud infrastructure, or compromised devices, source IPs stop being a dependable signal. Teams need behaviour-based detection that looks at session patterns, service access anomalies, and the legitimacy of the access path, not just the address that delivered the traffic.
Practitioner guidance
- Prioritise patching for internet-facing edge devices Create a separate remediation queue for VPNs, remote support tools, file-transfer appliances, and other public-facing services.
- Validate exposure against named exploit paths Test the specific CVEs and product classes highlighted in the advisory rather than relying on generic vulnerability coverage.
- Add behavioural detections for proxy-chained traffic Tune network and SOC detections for residential-IP sources, mixed cloud origin traffic, and unusual access to sensitive services.
What's in the full article
SafeBreach's full analysis covers the operational detail this post intentionally leaves for the source:
- Detailed breakdown of the 14 attributed CVEs and the specific products affected across the eight-year timeline
- Step-by-step description of QScan, QTRouter, and botnet infrastructure as an integrated exploitation supply chain
- The advisory's recommended validation priorities for edge-device patching, IOC handling, and behavioural detection
- The full incident timeline and attribution context behind the China-linked enabler ecosystem
👉 Read SafeBreach's analysis of QTFY’s industrial scanning and exploitation model →
QTFY scanning at scale: what defenders need to validate first?
Explore further
28/08/2026 12:04 pm
Industrial scanning is now a governance problem, not just a vulnerability problem. QTFY shows that attackers do not need targeted intelligence when they can automate discovery across the public internet. Once exploitation is industrialised, exposure management becomes a continuous governance function tied to remediation speed, asset inventory quality, and ownership clarity. Organisations that still treat perimeter hardening as a periodic task are already behind the threat model. The practical conclusion is that exposure governance must operate at machine speed.
A question worth separating out:
A: Accountability sits with the team responsible for runtime protection, network segmentation, and exposure management of the affected workload. Security leaders should ensure ingress controllers, gateways, and other public endpoints have controls for malicious payloads, blocked egress, and hardened container policies. When those safeguards are absent, the incident becomes a governance failure as well as a technical one.
👉 Read our full editorial: QTFY’s industrial scanning model shows why internet-facing exposure matters
