On August 26, 2026, the FBI, NSA, and U.S. Cyber Command’s Cyber National Mission Force released a joint cybersecurity advisory on China-linked hacking group QTFY, attributing it to Nanjing Xinjiuwei Network Technology Co. (XJW) (南京鑫玖维网络科技有限公司). Since at least 2018, QTFY has allegedly developed malicious tooling, traded malware and exploits within freelance hacking networks, established and maintained an obfuscation botnet, and targeted a wide range of U.S. government and critical-infrastructure networks, including the National Aeronautics and Space Administration, Federal Reserve, Department of Energy, Department of Justice, Department of Health and Human Services, National Institutes of Health, and the U.S. Senate.1
In its “QTFY Background” section, the advisory argues that XJW is linked to China’s Ministry of State Security (MSS) and highlights two primary channels of contact with state entities:2
Business relationships: XJW maintains business ties with larger China-based cybersecurity firms specializing in critical infrastructure security that allegedly facilitate operations against victim organizations.
Personnel networks: QTFY actors include former People’s Liberation Army (PLA) members who leverage military contacts to obtain contracts and subcontracting opportunities related to critical infrastructure targeting.
The same section names the entities with which XJW had business relationships as of June 2026: two MSS units – Unit 0718 and Unit 9086; two state entities – the Hunan Province Ecological and Environmental Construction Management Office (湖南省生态环境建设管理办公室) and the China Information Technology Testing and Evaluation Center, Jilin Subcenter (中国信息安全测评中心吉林分中心, CNITSEC/JITSEC);3 and five companies, including Bozhi Security Technology (博智安全, also known as Elextec Cybersecurity, Inc. or ELEX),4 and Nanjing Lexbell Information Technology (南京莱克贝尔信息技术有限公司).5 The advisory, however, says little about what these companies actually do, nor does it illustrate the business and personal relationships it identifies between them and the MSS or PLA.
This piece examines two of the five companies – ELEX and Lexbell – as case studies of these two channels in practice. First, the analysis examines ELEX’s capabilities, its status as a leading cyber range provider in China and its expertise in areas including vulnerability scanning and – beyond the scope of the recent US advisory – influence operations, and some products with intelligence and military applications we archived before they were subsequently removed from the company's website. It then shows that ELEX’s activity extends well beyond its stated business relationship with XJW: for years, the company’s own website listed its clients, including MSS and Ministry of Public Security (MPS) provincial bureaus alongside PLA-affiliated entities, a level of disclosure rarely seen from firms doing this kind of work. It then turn to Lexbell, examining its products with explicit military applications and reported PLA use, its leadership’s PLA-linked background, and its growing record of contract wins with PLA-affiliated National University of Defense Technology (国防科技大学, NUDT).
The piece concludes by considering what this new information adds to our understanding of China’s known modus operandi and what the advisory contributes to the broader picture.
The full list of approximately 300 ELEX clients, reconstructed from archived snapshots of the company’s website, is included in the appendix.
Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
<p>
<a href="https://www.nattothoughts.com/p/widening-the-circle-of-chinese-hacker" rel="noreferrer" target="_blank">
Read more
</a>
</p>
Article Link: Widening the Circle of Chinese Hacker Group QTFY: ELEX's Intelligence Client List and Lexbell's PLA Contracts