GHOST IN THE GRID

QTFY is the name federal investigators gave to a Chinese state-sponsored hacking group that had been operating since at least 2018. According to the joint FBI/NSA/Cyber National Mission Force advisory, QTFY is attributed to Nanjing Xinjiuwei Network Technology Co. (XJW) — a China-based "enabling company" that provides cyber operations services on behalf of the People's Republic of China. XJW maintained business relationships with units of China's Ministry of State Security and with larger private Chinese cyber-enabling firms specializing in critical infrastructure targeting.

According to the DOJ, QTFY "offers computer hacking services to its paying customers, including the PRC's Ministry of State Security and the People's Liberation Army." QTFY's own operatives include former members of the PLA. The group participated in China-based freelance hacker marketplaces — buying and selling exploits and network access like commodities — and took part in official Chinese "network attack and defense" exercises against Chinese critical infrastructure, using those exercises to sharpen the very tools later turned against the United States.

QTFY did not act alone. The advisory documents its relationships with a web of Chinese entities across multiple provinces: Unit 0718, an MSS unit tied to the Salt Typhoon hacking campaign; Unit 9086, an MSS unit in Guangxi Province with past contracts to the cyber intrusion firm i-Soon; Bozhi Security Technology, which bid on power-system vulnerability projects for China's National University of Defense Technology; and Fujian Ares Network Technology, which won multiple military contracts for radio frequency hardware. This was not one rogue actor. It was a functioning ecosystem.

The federal advisory lays out nearly a decade of documented QTFY activity against American systems — a slow, patient campaign of scanning, probing, and, in several confirmed cases, successful intrusion.

QTFY's operation ran on two connected platforms. QScan was the reconnaissance and exploitation engine — a distributed scanning system so large that on a single day in 2024, it processed over two million scanning and penetration-testing tasks. It carried a library of more than 200 proof-of-concept exploits, actively hunting for weaknesses in power companies, telecommunications firms, defense contractors, universities, and local governments around the world.

QTRouter was the mask. It functioned as an obfuscation network — a web of compromised home routers, smart devices, commercial proxy servers, and leased virtual servers spanning more than 130 countries. By routing their traffic through thousands of hijacked devices that belonged to ordinary people and businesses with no idea they'd been conscripted, QTFY's hackers could make their attacks on American power companies appear to originate from almost anywhere except China.

Behind both platforms sat three botnet-management systems the FBI identified: "Proxy Platform Management," the "Proxy Pool Management System," and "QTBotnet" — a full-featured control system capable of launching distributed denial-of-service attacks and executing remote commands on thousands of hijacked devices simultaneously. The advisory notes that QTFY has also been "heavily researching and integrating AI into their processes over the last two years" — meaning the machine was getting smarter even as investigators closed in.

Court documents unsealed in the Southern District of California detailed how federal investigators obtained authorization to seize the domains QTFY relied on. Because those domains were hard-coded directly into both the QScan and QTRouter malware — used for essential functions like communication and authentication — the seizure didn't just disrupt the network. It made both platforms completely inoperable in a single stroke.

This was not an isolated action. The DOJ press release places it in a documented pattern of recent U.S. operations against Chinese state-sponsored hacking infrastructure: in 2023, the FBI disrupted a botnet used by the group Volt Typhoon; in 2024, it disabled a botnet of hundreds of thousands of devices tied to Flax Typhoon; in 2025, it removed PlugX surveillance malware from over 4,000 U.S. computers infected by Mustang Panda. QTFY is the latest name on that list.

Within hours of the FBI announcing the QTFY takedown, the President signed Executive Order 14420, formally declaring a national emergency to secure the United States bulk-power system. The order does not name China outright in every clause, but its language leaves little ambiguity — it targets equipment "designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of a Covered Foreign Entity," with officials confirming the primary focus is China.

The order prohibits the acquisition, importation, transfer, or installation of foreign-produced bulk-power equipment — transformers, grid-connected inverters, battery storage systems, circuit breakers, industrial control systems — wherever that equipment "poses an undue risk of sabotage, subversion, unauthorized access, malicious remote action, or supply disruption." It gives the Secretary of Energy 120 days to publish concrete rules identifying high-risk equipment already installed on American soil and to decide, case by case, whether it must be isolated, monitored, or physically removed.

Security officials draw a sharp distinction between what QTFY was doing and ordinary hacking. Most cyber espionage exists to steal something — data, intellectual property, secrets. What investigators describe finding inside America's power infrastructure is different. It's called "cyber-positioning": the patient, years-long process of gaining and maintaining quiet access to critical systems, not to take anything today, but to have the capability to act — to sabotage, to disable, to shut something down — at a moment of the adversary's choosing, likely during a future war or international crisis.

That is the scenario the images from New York's 2019 blackout illustrate so plainly. A transformer failure took out power to a fraction of one American city for a few hours, and it made national news, stranded thousands, and shut down Times Square. The federal government's warning in 2026 is about an adversary with the patience and the access to potentially do something far larger, far more coordinated, and far less accidental — and they've been building toward that access for the better part of a decade.