FBI disrupts the Nanjing contractor that sold QScan and QTRouter to Chinese espionage operators

A quartermaster model splits the labor. One party writes the tooling, runs it, and sells access; other parties pick the targets. Both halves appear in the Bureau's description of this case: reconnaissance, proxy management and operational routing sold as capabilities, plus two frameworks the same group built and operated itself ^[1][2]. The framework names look like a straight map onto those functions, a scanner and a routing layer, though the material does not say that outright.

The consequence lands where analysts cluster activity. When a proxy address or a scan fingerprint belongs to a service, finding it in two unrelated intrusions establishes that two operators bought from the same shop, and nothing more. Infrastructure overlap has been doing heavy lifting in attribution for years. Against a shared supplier it degrades to a vendor match. Detection content keyed to QScan behaviour will fire for every customer of the service, which is useful for coverage and worthless for naming who is on the other end.

The seller is also a company with employees, and that is a different legal object than a persona ^[3]. Payroll, invoices, a customer list, an address in Nanjing.

Worth being plain about the evidence. The account here is a single weekly-recap item, published twice under the same headline, with no seizure date, no count of servers or domains taken offline, no sector breakdown for the critical infrastructure targets and no charged individuals ^[6]. Everything beyond the framework names is the FBI's characterization as relayed by one publisher ^[1].

The same roundup carries a firmware finding that the source does not connect to QTYF in any way ^[9]. Analysts pulled apart ZBT's Deep Orange LTE router and found SPEAKINGSTONE and DARKLANTERN, both rated 9.3, both predating the ENDLESSDOORS implant already documented in at least 21 of the vendor's firmware images ^[4][7][5]. That makes three separate backdoors at CVSS 9.3 in one vendor's code ^[8]. ENDLESSDOORS starts automatically and beacons as often as every 35 seconds, so one implanted router places 86,400 / 35, or about 2,468 outbound connections in a day ^[7][10]. At that cadence the traffic looks like vendor telemetry, because in one direction it is: SPEAKINGSTONE phones home to ZBT's own cloud infrastructure ^[5].

QScan and QTRouter are code. Code outlives a hosting seizure. What the disruption buys is the time the customers need to re-provision. Anyone holding scan traffic from that service in their logs is holding a targeting record; the case behind it stays open.