Signalis
sign in--:--:--UTC
Threat actors

QTFY

☆ pin
Reports
3
First seen
Aug 26, 2026
Last seen
Aug 26, 2026
Motivation
Espionage

Relationships

CVE-2018-13379, in 1 of QTFY's report, exploited in the wildCVE-2018-13379CVE-2019-10068, in 1 of QTFY's report, exploited in the wildCVE-2019-10068CVE-2019-19781, in 1 of QTFY's report, exploited in the wildCVE-2019-19781CVE-2020-5902, in 1 of QTFY's report, exploited in the wildCVE-2020-5902Co-mentioned with QTFY in 1 Signalis report (co-mention, not confirmed collaboration)×1nanjingxinj…Reports targeting GovernmentGovernmentQTFY

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors
Government ×3
Victim regions
×3
×3
United States×3

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1190 Exploit Public-Facing Application ×3T1090 Proxy ×3T1105 Ingress Tool Transfer ×2T1133 External Remote Services ×2T1046 Network Service Discovery ×1T1071 Application Layer Protocol ×1T1505.003 Web Shell ×1T1570 Lateral Tool Transfer ×1T1595 Active Scanning ×1T1070 Indicator Removal ×1T1583.006 Acquire Infrastructure: Web Services ×1T1498 Network Denial of Service ×1

Indicators

cve ×13domain ×7

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2018-13379 (exploited)CVE-2019-10068 (exploited)CVE-2019-19781 (exploited)CVE-2020-5902 (exploited)CVE-2021-26855 (exploited)CVE-2021-44228 (exploited)CVE-2023-22515 (exploited)CVE-2024-21887 (exploited)CVE-2024-8190 (exploited)CVE-2024-8963 (exploited)CVE-2024-9380 (exploited)

Recent reports

Critical

US authorities disrupt Chinese state-sponsored espionage operation targeting federal agencies and critical infrastructure

CyberScoopCritical

FBI Disrupts China-Linked QTFY Infrastructure Used to Steal Data From U.S. Organizations

The Hacker NewsCritical

US dismantles Chinese hacking tools QScan and QTRouter used against federal agencies

The Record (Recorded Future News)

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans