Cases › security breach › LR-2026-0669
Chinese state-sponsored hacking group QTFY proxy network disrupted by FBI and DOJ
Preliminary Why: 1 report: WIRED · subject to change · 1 independent report
Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.
Status: no action reported
No source states: loss or records, developer and model, agent tool, could do, deployer, industry.
Severity major: tier by the stated count test: the DOJ states successful breaches of four named US bodies (two or more affected parties). The FBI affidavit does not confirm which targets were breached, and a later update says attacks on the Senate and HHS were unsuccessful.
The sources describe no AI model. The sources describe a proxy network used by a Chinese state-sponsored hacking group, identified by the DOJ as QTFY, which allegedly relayed campaigns through two tools, QScan and QTRouter. QScan was designed to scan for vulnerable internet-of-things devices to add to proxy botnets, and QTRouter managed customer access to them. The hacking campaigns were reported to reach back to 2018, and the DOJ listed successful breaches of several US agencies. The FBI and Justice Department disrupted the infrastructure by seizing key domains, and Lumen null-routed certain domains.
What happened
No source tells the story step by step yet.
What was done
No source states an action or fix.
Risks
Primary96 incidents
Rising: 24 vs 4.0 a week
Sorted by rule from the case's fields; not yet read from the sources.
Controls
Not yet read for controls. Controls that mitigate the primary risk:
ModelSafety training and refusal · Cyber and weapons safeguards · Abuse monitoring and account enforcement · Staged or restricted release · Dangerous-capability testing before release · Outside red-teaming · Content safety classifiers · Safeguards kept on in testing · Reasoning monitoring
Infrastructure / targetKnown flaws patched · Multi-factor sign-in and password policy · Network segmentation · Intrusion and endpoint detection · Backups and recovery · Phishing and fraud filters
Similar incidents
Evidence
No source states: a step-by-step account, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.
Show the full account: 1 items from the primary sources
What happened, in order
- 2018 Hacking campaigns using the proxy services are reported to stretch back as early as 2018.
Show every field, with its source and grade
What happened
Impact
Notes on gaps
The source does not mention any AI model, agent or AI system, although the incident title says Chinese state hackers use AI models; the system, agent and AI-specific fields are therefore left out.
LR-2026-0669 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON