China-Linked Hacking Group QTFY Targets Military and Critical Infrastructure with Malicious Distributed Systems

    Thursday, August 27, 2026 In: Threat Research Print

    Date: 08/26/2026

    Severity: Critical

    Summary

    QTFY, a China-linked hacking group attributed to Nanjing Xinjiuwei Network Technology Co. (XJW), has conducted cyber operations targeting U.S. critical infrastructure, including the defense industrial base, telecommunications, local governments, and higher education. Since 2018, the group has developed and traded malware and exploits, maintained an obfuscation botnet, and leveraged freelance hacking networks to obtain and sell network access. Its links to PRC Ministry of State Security (MSS) units and former PLA personnel highlight the group’s broader China-linked operational ecosystem.  

    Indicators of Compromise (IOC) List

    Domains/Urls

    jump.qt-proxy.org

    jump.qt-team.com

    securelink.qtproxy.xyz

    www.qtproxy.xyz

    install.anticonstitutionally.sbs

    mail.fastsecurey.info

    www.fastsecurey.info

    mq-task.qt-proxy.org

    mq-result.qt-proxy.org

    mq-task.qt-team.com

    mq-result.qt-team.com

    adaadada.top

    anticonstitutionally.sbs

    apexrecord.top

    bigchains.net

    bigdataocean.net

    cataclysmdda.xyz

    categorystore.net

    ccgv.me

    daumcab.net

    dlview.net

    docker-hub.qt-team.com

    fastsecurey.info

    helicopter-crash.online

    huntger.store

    instantmessagehub.tech

    jump.qt-proxy.org

    jump.qt-team.com

    miandfish.store

    mirrorstorage.org

    mq-result.qt-proxy.org

    mq-result.qt-team.com

    mq-task.qt-proxy.org

    mq-task.qt-team.com

    newtourism.pw

    onlion.shop

    oraclelabs.biz

    qtcyber.com

    qtproxy.com

    qt-proxy.org

    qtproxy.tk

    qtproxy.xyz

    qt-team.com

    securityforce.cf

    serverbks.xyz

    taskqueue.work

    turandotarting.org

    vigorlabs.info

    vsky.tech

    whtsapp.online

    wintel.biz

    worldswar.online

    xinjiuwei.net

    IP Address

    1.32.216.171

    8.148.149.147

    45.202.210.27

    23.95.220.192

    103.201.131.121

    109.236.48.121

    206.119.167.207

    64.32.22.203

    148.135.90.22

    154.64.238.222

    154.64.238.247

    1.32.216.3

    1.32.216.4

    1.32.216.27

    1.32.216.33

    1.32.216.49

    1.32.216.77

    1.32.216.83

    1.32.216.92

    1.32.216.94

    1.32.216.104

    1.32.216.113

    1.32.216.123

    1.32.216.126

    1.32.216.130

    1.32.216.132

    1.32.216.145

    1.32.216.167

    1.32.216.177

    1.32.216.187

    1.32.216.225

    1.32.216.226

    23.225.180.171

    23.225.180.177

    23.225.195.20

    23.225.195.35

    23.225.195.44

    23.225.195.56

    27.124.24.220

    27.124.24.137

    38.14.63.7

    38.14.63.8

    38.14.63.179

    38.14.63.235

    45.147.200.105

    45.196.221.138

    45.196.221.149

    45.196.221.152

    45.202.65.135

    45.202.210.32

    69.176.89.102

    134.122.150.22

    134.122.150.25

    134.122.150.27

    134.122.150.73

    134.122.151.19

    134.122.186.21

    134.122.194.131

    134.122.194.135

    134.122.194.137

    134.122.194.143

    134.122.194.149

    134.122.194.161

    134.122.194.168

    134.122.194.170

    134.122.194.171

    134.122.194.173

    134.122.194.198

    134.122.194.209

    134.122.194.217

    134.122.194.222

    134.122.194.232

    134.122.194.235

    134.122.206.11

    137.220.181.142

    137.220.181.143

    137.220.181.196

    137.220.244.18

    137.220.244.23

    154.38.104.144

    154.38.105.11

    154.38.105.39

    154.38.105.109

    154.198.213.58

    155.94.129.191

    156.234.193.62

    156.234.193.79

    156.245.124.20

    156.245.124.25

    156.245.124.44

    156.245.124.47

    156.245.124.57

    156.245.124.82

    156.245.124.113

    156.245.124.115

    156.245.124.131

    156.245.124.157

    156.245.124.172

    156.245.124.180

    156.245.124.223

    156.245.124.243

    156.251.172.166

    156.251.172.167

    156.251.172.168

    172.247.15.222

    172.247.15.236

    198.50.168.185

    198.50.168.189

    1.32.216.31

    5.34.176.230

    5.34.183.142

    5.183.179.105

    5.183.179.120

    5.183.179.133

    23.95.82.90

    23.224.39.80

    23.224.46.224

    23.235.147.235

    23.238.217.23

    23.254.161.193

    23.254.164.48

    23.254.164.181

    23.254.167.3

    23.254.202.64

    23.254.227.240

    23.254.229.43

    23.254.250.188

    27.102.118.249

    27.102.127.93

    31.169.126.162

    31.170.160.61

    31.170.161.71

    31.170.161.78

    39.104.208.77

    43.240.12.129

    45.8.158.64

    45.8.159.228

    45.12.206.12

    45.12.206.26

    45.12.206.72

    45.12.206.76

    45.12.206.87

    45.12.206.234

    45.32.23.254

    45.32.32.50

    45.82.167.22

    45.82.167.112

    45.82.167.115

    45.82.167.121

    45.82.167.222

    45.90.57.148

    45.95.2.119

    45.117.102.170

    45.128.153.29

    45.128.153.126

    45.134.17.84

    45.154.2.94

    45.157.136.157

    45.157.136.158

    45.157.136.159

    45.199.188.1

    45.199.188.251

    45.199.189.122

    45.199.189.123

    46.3.242.214

    47.76.131.175

    47.88.175.61

    47.96.8.186

    47.122.42.2

    58.152.47.231

    62.216.88.18

    62.216.88.26

    64.32.15.23

    64.32.15.166

    64.32.15.198

    66.154.120.18

    75.140.50.69

    77.83.117.245

    78.142.19.106

    78.142.19.207

    79.143.186.63

    80.241.213.68

    80.241.213.90

    80.241.213.93

    85.143.202.117

    88.119.175.225

    88.119.175.229

    89.31.127.87

    89.31.127.242

    89.223.100.18

    91.194.90.213

    91.194.91.25

    91.194.91.84

    91.220.202.243

    92.38.139.64

    92.38.163.102

    94.156.236.183

    101.35.24.222

    103.83.157.38

    103.103.128.6

    103.114.161.228

    103.114.161.243

    103.114.163.112

    104.168.123.211

    104.168.145.175

    104.168.148.236

    104.168.153.230

    104.168.157.30

    104.168.158.113

    104.168.158.114

    104.168.158.181

    104.168.165.68

    104.168.166.42

    104.168.166.234

    104.168.170.48

    104.168.173.43

    104.168.173.191

    104.168.175.134

    104.168.194.148

    104.168.203.65

    104.168.211.139

    104.168.211.236

    104.234.174.5

    106.14.33.83

    106.14.68.99

    106.14.164.140

    106.14.184.69

    107.155.95.134

    107.175.215.126

    108.61.203.184

    108.174.199.29

    108.174.200.249

    109.166.36.217

    110.163.142.168

    111.223.246.9

    113.212.91.177

    118.31.35.233

    119.84.120.157

    119.237.159.189

    120.27.150.114

    122.112.169.163

    141.164.39.12

    142.11.211.86

    142.11.211.250

    142.11.212.111

    142.11.213.132

    142.11.213.254

    142.11.215.132

    142.11.219.75

    142.11.227.204

    142.11.227.246

    142.11.236.143

    142.11.237.112

    154.85.14.250

    154.85.32.39

    154.85.32.43

    154.198.212.233

    154.210.13.78

    154.211.2.78

    156.23.19.18

    156.67.220.50

    156.234.193.18

    156.234.193.182

    167.160.86.103

    167.160.86.168

    173.231.242.82

    173.247.227.62

    173.247.232.36

    173.247.232.38

    185.2.103.236

    185.14.31.21

    185.62.189.42

    185.82.216.142

    185.82.218.133

    185.126.116.236

    185.141.24.3

    185.160.24.70

    185.162.128.136

    185.167.116.125

    185.172.65.80

    185.173.235.54

    185.173.235.172

    185.194.216.13

    185.198.56.14

    185.198.58.131

    185.198.58.240

    185.198.58.241

    185.201.9.198

    185.234.218.240

    185.239.69.163

    188.209.49.95

    192.119.73.100

    192.119.73.107

    192.119.73.108

    192.119.77.232

    192.236.147.72

    192.236.162.232

    192.236.163.117

    192.236.163.119

    192.236.178.206

    192.236.178.207

    192.236.179.163

    192.236.179.164

    192.236.179.166

    192.236.179.167

    192.236.179.173

    192.236.179.216

    192.236.179.254

    192.236.192.3

    192.236.192.4

    192.236.192.5

    192.236.192.6

    192.236.192.119

    193.34.144.131

    193.38.51.46

    193.160.32.138

    193.160.32.141

    193.160.65.116

    193.160.96.154

    193.200.241.157

    194.104.10.58

    194.124.33.93

    194.124.35.104

    194.126.173.71

    194.126.173.154

    194.156.120.205

    195.123.213.218

    195.123.237.33

    195.123.240.47

    198.13.37.185

    198.44.14.72

    198.44.15.200

    198.46.233.13

    198.50.168.176

    198.50.168.182

    198.74.112.85

    198.84.122.140

    208.51.62.181

    213.136.66.213

    213.183.56.96

    213.252.244.38

    213.252.244.51

    218.66.59.169

    221.226.197.238

    222.99.101.22

    Hash

    d810f1253ee4bee05ca96a70a9c293f2839fb00b2aa238861f7b89e3a66bd357

    7a4c87677d7892b66c30c82ea72893bd29cfe793fade45222b4cf853b877d300

    c1381b35c21aec9e74e8d42b60c4733abd23fd012c75ab0e9101e37c9be62a7a

    e939954618ec089485eff4de098f6c5ce4d672acfd03150f5f0b38bbecbba664

    6decf77b1a3595374a15a014bbb9ac9774f67dca7df59ccf4b734a68d9e35224

    5329f26cc11cba660382f58f388d2dad50e10e2ba37d0d6002622c8061b211b2

    69a20babb22ffb372733900cb2e6739598b316aecdbc0394ce8029717ee13089

    9759492bc73a1704d6d71c6f40ab5321a095f9ab2ae5ca069dd4f7b3a98235fa

    dd014653fce1fe5f19d1b0e1ad5f254118ca6d002e29c549ecb15029ed0a381e

    c7abdd66dae9f0e190361d7a39a73128e9d7dc3da338c02f3d93488786813eb3

    6547c0f20c7770bb228b9b0ac61a6d2e16e74afad37b62bcecc7e69b51354a87

    6547c0f20c7770bb228b9b0ac61a6d2e16e74afad37b62bcecc7e69b51354a87

    12b1f2078fcdcf792e5482308acaea8cc617c58d51019edd4a381fef52329dec

    00b0045e9e28b89946e7e839ac910f1f2e6f3c28937839aff3b0b41008c80188

    ea89a969d7a4e4b9c3da24577fe2d633f74c4f25fd1494905063b40b57aeca31

    7bba7912b7fc01795b3a0503d0e546087990124a2256b083c1c5a498a205a72

    26c9b561e431d033aa16f94580bfa7ace390a1c9c6834a0ee1a6b0a9a306485c

    bb1428134f6f587d63a3092ef125a7a2ac50fda3ee71b830bf725f20956b0d3f

    ef1b84fa1f3087415ba1e798b018f35c675de1032723579e38d81f79dcc37878

    ab745ad10ffcbf65acdf171cd47d20aed581ac07304570d96caffacc6ece2651

    996b3aedb34426184ca4f8141daec29a0c5785b11e7eea47559f2e0ef1e6180a

    ce8832b4681e63118c159f379de82f8c97adc62a81c19cae903d1ba0e5629cf1

    08dc78ae82d9c480420f7cfa797334c8976077a02df5f6b4cee3072ed4a197f9

    ba20494fe5a12955a408f076c3677bf8ae600c890554b9906049b8cd07206cfb

    5c0708b7a7a7ca00188b40df6b80f4875b2e430b2b0c38b68dd9428bfcb98d09

    0d48039b416a236f6e0e0fd702b5a824e8c7118af597c81271c64bd6b0adfec2

    ad2fae2894432da7b82fec0d5d3a75b5ffa1b84a50ad67477b6063a1769a3846

    dbcd1588caae92b7525aac096b7ec8c543b5ab8c4c95dfb33051d42c351e19b3

    86881181d7244a8e9d45f5fe1e2b7f4c3e8bd6cd1e6383c92693ee956c4d87fb

    dc0624c316667b89aa88afa716933235584a27d14b2a08606e43a657a95db99

    239b9f5677b66d3dc69e003028d041c09440330dd367763e68c0a56454afd91a

    b3b32e592a73d46566c51ed18c07155ad3d980142f1a4c32c4e9728208c02fce

    2d29f9f75e40e5b58cb4379d44ff7b511620e8dea584ffaf4db6a7597ee23562

    5653a062a37d8a650c9a603cee0e7744af128bad28be8916c9de9ac16f1a82e5

    ed24ea239799e470c66d160eb7b097ab1d7627fc6c51236d6169da920f5b3b5c

    92e9c9c36d469d56fbeba052d3062b77cd869c6df8f10faafd184717c557a245

    c73bd1c498a147e71e345a99f5f85e3442243c2a7b7cb65f0d00a72acc0a87e7

    bea44e8cbf35c240c9cddc88284b6f8f94129e4e0a42a85e2603406980b83990

    a617e06c27d3514c57fd83711c75846d798e3ecefd5a0246b5ac9a191392e98a

    c337b92789987efe8ae0afcd56da948b38aa4b0e5859f2d51a61e2bc152c1feb

    5fb500afd83fb64f64a2789abc66f0a158d915167e1def6ba56d9543dd9de3d7

    c46944343b7e33c0f88ca9583b8145a4735d6e9780f9df1777b4c59887b56a35

    0cf8ed7064d3d4827f841451c661d788d4cf7d067901e35a7a019f1c9d5ef656

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1 :

    domainname like "jump.qt-proxy.org" or siteurl like "jump.qt-proxy.org" or url like "jump.qt-proxy.org" or domainname like "jump.qt-team.com" or siteurl like "jump.qt-team.com" or url like "jump.qt-team.com" or domainname like "securelink.qtproxy.xyz" or siteurl like "securelink.qtproxy.xyz" or url like "securelink.qtproxy.xyz" or domainname like "www.qtproxy.xyz" or siteurl like "www.qtproxy.xyz" or url like "www.qtproxy.xyz" or domainname like "install.anticonstitutionally.sbs" or siteurl like "install.anticonstitutionally.sbs" or url like "install.anticonstitutionally.sbs" or domainname like "mail.fastsecurey.info" or siteurl like "mail.fastsecurey.info" or url like "mail.fastsecurey.info" or domainname like "www.fastsecurey.info" or siteurl like "www.fastsecurey.info" or url like "www.fastsecurey.info" or domainname like "mq-task.qt-proxy.org" or siteurl like "mq-task.qt-proxy.org" or url like "mq-task.qt-proxy.org" or domainname like "mq-result.qt-proxy.org" or siteurl like "mq-result.qt-proxy.org" or url like "mq-result.qt-proxy.org" or domainname like "mq-task.qt-team.com" or siteurl like "mq-task.qt-team.com" or url like "mq-task.qt-team.com" or domainname like "mq-result.qt-team.com" or siteurl like "mq-result.qt-team.com" or url like "mq-result.qt-team.com" or domainname like "adaadada.top" or siteurl like "adaadada.top" or url like "adaadada.top" or domainname like "anticonstitutionally.sbs" or siteurl like "anticonstitutionally.sbs" or url like "anticonstitutionally.sbs" or domainname like "apexrecord.top" or siteurl like "apexrecord.top" or url like "apexrecord.top" or domainname like "bigchains.net" or siteurl like "bigchains.net" or url like "bigchains.net" or domainname like "bigdataocean.net" or siteurl like "bigdataocean.net" or url like "bigdataocean.net" or domainname like "cataclysmdda.xyz" or siteurl like "cataclysmdda.xyz" or url like "cataclysmdda.xyz" or domainname like "categorystore.net" or siteurl like "categorystore.net" or url like "categorystore.net" or domainname like "ccgv.me" or siteurl like "ccgv.me" or url like "ccgv.me" or domainname like "daumcab.net" or siteurl like "daumcab.net" or url like "daumcab.net" or domainname like "dlview.net" or siteurl like "dlview.net" or url like "dlview.net" or domainname like "docker-hub.qt-team.com" or siteurl like "docker-hub.qt-team.com" or url like "docker-hub.qt-team.com" or domainname like "fastsecurey.info" or siteurl like "fastsecurey.info" or url like "fastsecurey.info" or domainname like "helicopter-crash.online" or siteurl like "helicopter-crash.online" or url like "helicopter-crash.online" or domainname like "huntger.store" or siteurl like "huntger.store" or url like "huntger.store" or domainname like "instantmessagehub.tech" or siteurl like "instantmessagehub.tech" or url like "instantmessagehub.tech" or domainname like "miandfish.store" or siteurl like "miandfish.store" or url like "miandfish.store" or domainname like "mirrorstorage.org" or siteurl like "mirrorstorage.org" or url like "mirrorstorage.org" or domainname like "newtourism.pw" or siteurl like "newtourism.pw" or url like "newtourism.pw" or domainname like "onlion.shop" or siteurl like "onlion.shop" or url like "onlion.shop" or domainname like "oraclelabs.biz" or siteurl like "oraclelabs.biz" or url like "oraclelabs.biz" or domainname like "qtcyber.com" or siteurl like "qtcyber.com" or url like "qtcyber.com" or domainname like "qtproxy.com" or siteurl like "qtproxy.com" or url like "qtproxy.com" or domainname like "qt-proxy.org" or siteurl like "qt-proxy.org" or url like "qt-proxy.org" or domainname like "qtproxy.tk" or siteurl like "qtproxy.tk" or url like "qtproxy.tk" or domainname like "qtproxy.xyz" or siteurl like "qtproxy.xyz" or url like "qtproxy.xyz" or domainname like "qt-team.com" or siteurl like "qt-team.com" or url like "qt-team.com" or domainname like "securityforce.cf" or siteurl like "securityforce.cf" or url like "securityforce.cf" or domainname like "serverbks.xyz" or siteurl like "serverbks.xyz" or url like "serverbks.xyz" or domainname like "taskqueue.work" or siteurl like "taskqueue.work" or url like "taskqueue.work" or domainname like "turandotarting.org" or siteurl like "turandotarting.org" or url like "turandotarting.org" or domainname like "vigorlabs.info" or siteurl like "vigorlabs.info" or url like "vigorlabs.info" or domainname like "vsky.tech" or siteurl like "vsky.tech" or url like "vsky.tech" or domainname like "whtsapp.online" or siteurl like "whtsapp.online" or url like "whtsapp.online" or domainname like "wintel.biz" or siteurl like "wintel.biz" or url like "wintel.biz" or domainname like "worldswar.online" or siteurl like "worldswar.online" or url like "worldswar.online" or domainname like "xinjiuwei.net" or siteurl like "xinjiuwei.net" or url like "xinjiuwei.net"

    Detection Query 2 :

    dstipaddress IN ("1.32.216.171","8.148.149.147","45.202.210.27","23.95.220.192","103.201.131.121","109.236.48.121","206.119.167.207","64.32.22.203","148.135.90.22","154.64.238.222","154.64.238.247","1.32.216.3","1.32.216.4","1.32.216.27","1.32.216.33","1.32.216.49","1.32.216.77","1.32.216.83","1.32.216.92","1.32.216.94","1.32.216.104","1.32.216.113","1.32.216.123","1.32.216.126","1.32.216.130","1.32.216.132","1.32.216.145","1.32.216.167","1.32.216.177","1.32.216.187","1.32.216.225","1.32.216.226","23.225.180.171","23.225.180.177","23.225.195.20","23.225.195.35","23.225.195.44","23.225.195.56","27.124.24.220","27.124.24.137","38.14.63.7","38.14.63.8","38.14.63.179","38.14.63.235","45.147.200.105","45.196.221.138","45.196.221.149","45.196.221.152","45.202.65.135","45.202.210.32","69.176.89.102","134.122.150.22","134.122.150.25","134.122.150.27","134.122.150.73","134.122.151.19","134.122.186.21","134.122.194.131","134.122.194.135","134.122.194.137","134.122.194.143","134.122.194.149","134.122.194.161","134.122.194.168","134.122.194.170","134.122.194.171","134.122.194.173","134.122.194.198","134.122.194.209","134.122.194.217","134.122.194.222","134.122.194.232","134.122.194.235","134.122.206.11","137.220.181.142","137.220.181.143","137.220.181.196","137.220.244.18","137.220.244.23","154.38.104.144","154.38.105.11","154.38.105.39","154.38.105.109","154.198.213.58","155.94.129.191","156.234.193.62","156.234.193.79","156.245.124.20","156.245.124.25","156.245.124.44","156.245.124.47","156.245.124.57","156.245.124.82","156.245.124.113","156.245.124.115","156.245.124.131","156.245.124.157","156.245.124.172","156.245.124.180","156.245.124.223","156.245.124.243","156.251.172.166","156.251.172.167","156.251.172.168","172.247.15.222","172.247.15.236","198.50.168.185","198.50.168.189","1.32.216.31","5.34.176.230","5.34.183.142","5.183.179.105","5.183.179.120","5.183.179.133","23.95.82.90","23.224.39.80","23.224.46.224","23.235.147.235","23.238.217.23","23.254.161.193","23.254.164.48","23.254.164.181","23.254.167.3","23.254.202.64","23.254.227.240","23.254.229.43","23.254.250.188","27.102.118.249","27.102.127.93","31.169.126.162","31.170.160.61","31.170.161.71","31.170.161.78","39.104.208.77","43.240.12.129","45.8.158.64","45.8.159.228","45.12.206.12","45.12.206.26","45.12.206.72","45.12.206.76","45.12.206.87","45.12.206.234","45.32.23.254","45.32.32.50","45.82.167.22","45.82.167.112","45.82.167.115","45.82.167.121","45.82.167.222","45.90.57.148","45.95.2.119","45.117.102.170","45.128.153.29","45.128.153.126","45.134.17.84","45.154.2.94","45.157.136.157","45.157.136.158","45.157.136.159","45.199.188.1","45.199.188.251","45.199.189.122","45.199.189.123","46.3.242.214","47.76.131.175","47.88.175.61","47.96.8.186","47.122.42.2","58.152.47.231","62.216.88.18","62.216.88.26","64.32.15.23","64.32.15.166","64.32.15.198","66.154.120.18","75.140.50.69","77.83.117.245","78.142.19.106","78.142.19.207","79.143.186.63","80.241.213.68","80.241.213.90","80.241.213.93","85.143.202.117","88.119.175.225","88.119.175.229","89.31.127.87","89.31.127.242","89.223.100.18","91.194.90.213","91.194.91.25","91.194.91.84","91.220.202.243","92.38.139.64","92.38.163.102","94.156.236.183","101.35.24.222","103.83.157.38","103.103.128.6","103.114.161.228","103.114.161.243","103.114.163.112","104.168.123.211","104.168.145.175","104.168.148.236","104.168.153.230","104.168.157.30","104.168.158.113","104.168.158.114","104.168.158.181","104.168.165.68","104.168.166.42","104.168.166.234","104.168.170.48","104.168.173.43","104.168.173.191","104.168.175.134","104.168.194.148","104.168.203.65","104.168.211.139","104.168.211.236","104.234.174.5","106.14.33.83","106.14.68.99","106.14.164.140","106.14.184.69","107.155.95.134","107.175.215.126","108.61.203.184","108.174.199.29","108.174.200.249") or srcipaddress IN ("109.166.36.217","110.163.142.168","111.223.246.9","113.212.91.177","118.31.35.233","119.84.120.157","119.237.159.189","120.27.150.114","122.112.169.163","141.164.39.12","142.11.211.86","142.11.211.250","142.11.212.111","142.11.213.132","142.11.213.254","142.11.215.132","142.11.219.75","142.11.227.204","142.11.227.246","142.11.236.143","142.11.237.112","154.85.14.250","154.85.32.39","154.85.32.43","154.198.212.233","154.210.13.78","154.211.2.78","156.23.19.18","156.67.220.50","156.234.193.18","156.234.193.182","167.160.86.103","167.160.86.168","173.231.242.82","173.247.227.62","173.247.232.36","173.247.232.38","185.2.103.236","185.14.31.21","185.62.189.42","185.82.216.142","185.82.218.133","185.126.116.236","185.141.24.3","185.160.24.70","185.162.128.136","185.167.116.125","185.172.65.80","185.173.235.54","185.173.235.172","185.194.216.13","185.198.56.14","185.198.58.131","185.198.58.240","185.198.58.241","185.201.9.198","185.234.218.240","185.239.69.163","188.209.49.95","192.119.73.100","192.119.73.107","192.119.73.108","192.119.77.232","192.236.147.72","192.236.162.232","192.236.163.117","192.236.163.119","192.236.178.206","192.236.178.207","192.236.179.163","192.236.179.164","192.236.179.166","192.236.179.167","192.236.179.173","192.236.179.216","192.236.179.254","192.236.192.3","192.236.192.4","192.236.192.5","192.236.192.6","192.236.192.119","193.34.144.131","193.38.51.46","193.160.32.138","193.160.32.141","193.160.65.116","193.160.96.154","193.200.241.157","194.104.10.58","194.124.33.93","194.124.35.104","194.126.173.71","194.126.173.154","194.156.120.205","195.123.213.218","195.123.237.33","195.123.240.47","198.13.37.185","198.44.14.72","198.44.15.200","198.46.233.13","198.50.168.176","198.50.168.182","198.74.112.85","198.84.122.140","208.51.62.181","213.136.66.213","213.183.56.96","213.252.244.38","213.252.244.51","218.66.59.169","221.226.197.238","222.99.101.22")

    Detection Query 3 :

    sha256hash in ("d810f1253ee4bee05ca96a70a9c293f2839fb00b2aa238861f7b89e3a66bd357","7a4c87677d7892b66c30c82ea72893bd29cfe793fade45222b4cf853b877d300","c1381b35c21aec9e74e8d42b60c4733abd23fd012c75ab0e9101e37c9be62a7a","e939954618ec089485eff4de098f6c5ce4d672acfd03150f5f0b38bbecbba664","6decf77b1a3595374a15a014bbb9ac9774f67dca7df59ccf4b734a68d9e35224","5329f26cc11cba660382f58f388d2dad50e10e2ba37d0d6002622c8061b211b2","69a20babb22ffb372733900cb2e6739598b316aecdbc0394ce8029717ee13089","9759492bc73a1704d6d71c6f40ab5321a095f9ab2ae5ca069dd4f7b3a98235fa","dd014653fce1fe5f19d1b0e1ad5f254118ca6d002e29c549ecb15029ed0a381e","c7abdd66dae9f0e190361d7a39a73128e9d7dc3da338c02f3d93488786813eb3","6547c0f20c7770bb228b9b0ac61a6d2e16e74afad37b62bcecc7e69b51354a87","6547c0f20c7770bb228b9b0ac61a6d2e16e74afad37b62bcecc7e69b51354a87","12b1f2078fcdcf792e5482308acaea8cc617c58d51019edd4a381fef52329dec","00b0045e9e28b89946e7e839ac910f1f2e6f3c28937839aff3b0b41008c80188","ea89a969d7a4e4b9c3da24577fe2d633f74c4f25fd1494905063b40b57aeca31","7bba7912b7fc01795b3a0503d0e546087990124a2256b083c1c5a498a205a72","26c9b561e431d033aa16f94580bfa7ace390a1c9c6834a0ee1a6b0a9a306485c","bb1428134f6f587d63a3092ef125a7a2ac50fda3ee71b830bf725f20956b0d3f","ef1b84fa1f3087415ba1e798b018f35c675de1032723579e38d81f79dcc37878","ab745ad10ffcbf65acdf171cd47d20aed581ac07304570d96caffacc6ece2651","996b3aedb34426184ca4f8141daec29a0c5785b11e7eea47559f2e0ef1e6180a","ce8832b4681e63118c159f379de82f8c97adc62a81c19cae903d1ba0e5629cf1","08dc78ae82d9c480420f7cfa797334c8976077a02df5f6b4cee3072ed4a197f9","ba20494fe5a12955a408f076c3677bf8ae600c890554b9906049b8cd07206cfb","5c0708b7a7a7ca00188b40df6b80f4875b2e430b2b0c38b68dd9428bfcb98d09","0d48039b416a236f6e0e0fd702b5a824e8c7118af597c81271c64bd6b0adfec2","ad2fae2894432da7b82fec0d5d3a75b5ffa1b84a50ad67477b6063a1769a3846","dbcd1588caae92b7525aac096b7ec8c543b5ab8c4c95dfb33051d42c351e19b3","86881181d7244a8e9d45f5fe1e2b7f4c3e8bd6cd1e6383c92693ee956c4d87fb","dc0624c316667b89aa88afa716933235584a27d14b2a08606e43a657a95db99","239b9f5677b66d3dc69e003028d041c09440330dd367763e68c0a56454afd91a","b3b32e592a73d46566c51ed18c07155ad3d980142f1a4c32c4e9728208c02fce","2d29f9f75e40e5b58cb4379d44ff7b511620e8dea584ffaf4db6a7597ee23562","5653a062a37d8a650c9a603cee0e7744af128bad28be8916c9de9ac16f1a82e5","ed24ea239799e470c66d160eb7b097ab1d7627fc6c51236d6169da920f5b3b5c","92e9c9c36d469d56fbeba052d3062b77cd869c6df8f10faafd184717c557a245","c73bd1c498a147e71e345a99f5f85e3442243c2a7b7cb65f0d00a72acc0a87e7","bea44e8cbf35c240c9cddc88284b6f8f94129e4e0a42a85e2603406980b83990","a617e06c27d3514c57fd83711c75846d798e3ecefd5a0246b5ac9a191392e98a","c337b92789987efe8ae0afcd56da948b38aa4b0e5859f2d51a61e2bc152c1feb","5fb500afd83fb64f64a2789abc66f0a158d915167e1def6ba56d9543dd9de3d7","c46944343b7e33c0f88ca9583b8145a4735d6e9780f9df1777b4c59887b56a35","0cf8ed7064d3d4827f841451c661d788d4cf7d067901e35a7a019f1c9d5ef656")

    Reference:   

    https://media.defense.gov/2026/Aug/26/2003986916/-1/-1/0/JCSA_CHINA_QTFY_MALICIOUS_SYSTEMS.PDF


    Tags

    MalwareThreat ActorChinaUnited StatesCritical InfrastructureDefense Industrial BaseCommunicationsGovernment Services and FacilitiesEducationObfuscationBotnetPRC stateExploit

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.