🚨 ACTIVE EXPLOITATION
7 | DOJ seizes QTFY domains used to target U.S. critical infrastructure
The DOJ and FBI seized domains used by Chinese hacking group QTFY.
• QTFY targeted U.S. critical infrastructure, federal agencies, hospitals, utilities, universities and defense contractors.
• Targets included NASA, the Federal Reserve, the Departments of Energy, Justice and Health and Human Services, NIH and the Senate.
• QScan scanned and automatically infected thousands of internet-connected IoT devices worldwide.
• QTRouter routed attacks through compromised IoT devices, commercial proxies and leased VPSs to conceal their origin.
• Three seized domains were hard-coded into QScan and QTRouter for communication and authentication, making the platforms inoperable.
🔓 CVEs & KEV
CVE-2026-83596 — CVSS 8.8 — WebKitGTK Memory Corruption via Malicious Web Content (CVE-2026-83596)
CVE-2026-82882 — CVSS 8.7 — Devtron through 2.2.0 Missing Authorization via webhook API token endpointDev...
CVE-2026-33407 — Wallosapp Wallos — CVSS 8.3 — Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still ...
CVE-2026-77348 — CVSS 8.2 — Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still ...
CVE-2026-82397 — CVSS 7.5 — Tornado: Urlencoded body parsing omits max_num_fields, so one request can sta...
CVE-2026-82393 — CVSS 7.5 — pnpm: A tarball dependency's manifest
nameescapes node_modules → arbitrary...CVE-2026-82392 — CVSS 7.1 — pnpm: Virtual store linker path traversal via unvalidated depPath name in loc...
CVE-2026-82398 — CVSS 6.9 — pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace...
CVE-2026-62993 — CVSS 6.9 — Smarty: SSRF via redirect bypass of trusted_uri using {fetch}Smarty is a temp...