US Disables China-Linked Hacking Tools, Urges Banks to Tighten Defenses

China-linked hacking group QTFY has operated since at least 2018, developing tools for Nanjing Xinjiuwei Network Technology, a contractor that U.S. authorities say served clients including China’s Ministry of State Security and People’s Liberation Army. Its QScan platform found and compromised vulnerable internet-connected devices, while QTRouter routed attacks through those devices and commercial proxies, obscuring their origin. The infrastructure raised particular concerns for banks because financial networks hold valuable data and support systemically important services.

The U.S. Justice Department and FBI said on Aug. 26, 2026, that court-authorized seizures of domains hard-coded into QScan and QTRouter rendered both platforms inoperable. Investigators said QTFY exfiltrated data from more than 300 organizations worldwide in 2024, with financial and insurance companies accounting for many victims. Authorities and cybersecurity specialists urged banks to review historical logs for indicators of compromise, patch software and firmware promptly, audit internet-facing applications and separate critical systems from vulnerable edge devices.