31-08-2026
The Scan Factory: Inside China’s QTFY and the Business of Breaking In
https://www.safebreach.com/blog/qtfy-scan-factory-china-hacking-group/
Report completeness: Medium
Actors/Campaigns:
Qtfy (motivation: cyber_espionage)
I-soon_leak (motivation: cyber_espionage)
Threats:
Qscan_tool
Residential_proxy_technique
Qtrouter
Supply_chain_technique
Log4shell_vuln
Proxylogon_exploit
Beyondtrust_tool
Qtbotnet
Victims:
Defense industrial base, Communications, Energy, Government, Higher education, Financial institutions, Water utilities, Healthcare, Election systems
Industry:
Critical_infrastructure, Energy, Iot, Education, Government, Healthcare
Geo:
China, Chinese
CVEs:
CVE-2024-24919 [Vulners]
CVSS V3.1: 8.6,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- checkpoint quantum_spark_firmware (r80.40)
CVE-2026-1731 [Vulners]
CVSS V3.1: 9.8,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- beyondtrust privileged_remote_access (<25.1)
- beyondtrust remote_support (<25.3.2)
TTPs:
Tactics: 1
Technics: 0
ChatGPT TTPs:
do not use without manual checkT1090.002, T1090.003, T1190, T1498, T1583.005, T1588.005, T1590.001, T1592.002, T1595, T1650, have more...
IOCs:
Domain: 1
Soft:
Alibaba Cloud, Ivanti, RabbitMQ, Redis, OpenWrt
Languages:
python
Platforms:
apple
