The QTFY Hunt: How Chinese Hackers Were Tracked and How the Internet Became the Sensor

Key judgements

QTFY is better understood as an infrastructure quartermaster than a conventional hacking group: its role appears to be providing reconnaissance, access and obfuscation capabilities as reusable services to multiple state customers.

Much of its concealment capability appears to have been procured rather than built through compromise. Espionage traffic was routed through subscriptions to a commercial Chinese proxy service, allowing it to blend into ordinary consumer traffic rather than relying on obviously malicious infrastructure.

That model exposes the limits of static blocking a…