The QScan seizure turns 390 indicators into a years-deep log review for banks

Justice Department and FBI agents seized three domains running QScan, which scanned the internet for vulnerable machines and broke into them, and QTRouter, a network built to disguise where an attack came from.

The government attributes QScan and QTRouter to QTFY, a group employed by Nanjing Xinjiuwei Network Technology Co. that sells hacking services to China's Ministry of State Security and the People's Liberation Army, according to the Justice Department.

The details the government shared affect all banks, which are considered critical infrastructure, and point in particular to the dangers of not patching software vulnerabilities in a timely manner.

The affidavit documents a selection of four earlier victims, including three financial or insurance firms, each of which had complained about suspicious activity.

ETH Zurich researcher Eugenio Benincasa said "the Chinese market isn't short on scanning services, so this probably won't deter operations over the medium to long term."

The attackers ran the four documented attacks from servers they leased from Hostwinds, a U.S. hosting company, so all four victims sent their abuse complaints there.

Mark Orsi, chief executive of the Global Resilience Federation and previously a cybersecurity executive at large banks, said the financial skew among the four affidavit anecdotes mostly reflects how the sector behaves, because financial institutions "tend to have stronger detection, reporting and information-sharing capabilities which can make them more visible in investigations."

Jason Healey, a senior research scholar at Columbia University and former vice chair of the Financial Services Information Sharing and Analysis Center, said: "I haven't followed this group, but this does not sound like any major targeting of the finance sector."

A financial group in Michigan listed eight of the released addresses attacking it over roughly a month, a financial group in South Korea reported the addresses scanning its network, and an insurance agency in Missouri reported that it was targeted.

According to Orsi, blocking the addresses the advisory lists is actually one of the last steps a bank should take.

A bank that runs any of the products named in the advisory should confirm they were patched and work out whether those machines were exposed during the years the group was exploiting them, which is a question about historical logs rather than about new attacks.

Orsi said an initial review of the indicators "is not a heavy lift for a midsize bank," but someone has to triage the results.

Orsi advised that a bank without sufficient staff should route the advisory to its managed security provider or incident-response firm for a sweep of old logs, keeping the workload for bank staff manageable.

Healey said much of the review work is already automatic.

The eight addresses the Michigan financial group observed are about 2 percent of the roughly 390 indicators the advisory lists.

Three of the four victims documented in the affidavit, or 75 percent of that sample, are financial or insurance firms.

No bank has been named as a victim in the campaign; the affidavit identifies its victims by pseudonym, and the U.S. has not named any of the 300-plus organizations the threat actors robbed in 2024.