America’s Botnet War Is Already Here -By Fransiscus Nanga Roka

This takedown of the QTFY botnet by the DOJ and FBI is no ordinary cybercrime story. A warning shot in a war which most democracies are still shy to divinely characterize. Prosecutors say that hide an ecosystem of China-linked hacking behind a private contractor, infected ordinary smart devices in over 130 countries with malware, and camouflaged — where homes, offices, and villages were the camouflage for attacks on critical infrastructure, federal institutions and strategic networks. That is not routine espionage. What is that, industrial digital penetration but on a global scale.

According to US authorities, they have dismantled a significant piece of infrastructure related to QScan and QTRouter, two custom platforms that investigators contend were used by QTFY to scan the internet in order to penetrate vulnerable IoT devices with a view to creating a huge hidden proxy network. Investigators appear to have successfully shut down command, authentication and coordination functions of the system by grabbing domains that were allegedly hard-wired into the malware.

In the US case, QTFY masqueraded as a private contractor called Nanjing Xinjiuwei Network Technology Company, which purported to sell hacked data and hacking services to Chinese state organs like the MSS and PLA. Perhaps the most chilling claim which comes if true is that state power has crystallized and been outsourced to deniable private actors. It helps a government to reap strategic advantage while obscuring attribution and political accountability.

The operation is believed to date back as far as 2018 with activity continuing at least until 2024 and possibly later, including exploitation of Ivanti and Check Point vulnerabilities against 300+ organizations around the world. It was not an isolated intrusion. It was a patient campaign that you could scale.

All over the world. The victims were international; those involved military, comms, healthcare, energy, and both academic and state institutions— organizations like NASA and the backend of the US Senate all fell victim to these breaches along with hospitals, utilities, and power industries & agencies. Geography is not so much as architecture: in a hyperconnected world any unpatched router is a missile pod trained on your nation-state.

It is largely because the line between civilian life and strategic infrastructure has collapsed. That home router of yours is now somebody else’s problem. Your security camera is not a consumer appliance anymore. During this post-botnet phase even the household device with the weakest security can be turned into a plausible deniability weapon in a geopolitical act of sabotage. Data is not the only target. It is a matter of trust— trust in attribution, trust in deterrence, trust that democracies will defend themselves without overreacting.

With brutal efficiency. QScan hunted exposed devices. QTRouter took advantage of the already compromised machines and used them to launder the malicious traffic. That meant that attacks could be made to look like they came from servers on a local IP address and not those who originally ran it. Stealth is king in cyber warfare. And this model is relatively inexpensive and scalable— but is dangerously reproducible.

The strategic takeaway is uncomfortable: The US and its allies defend endpoints, while adversaries weaponize the entire digital environment.

Strategic blindness is treating insecure IoT as a simple consumer nuisance. Routers, cameras, DVRs and NAS devices, which were once not a threat to the soft tissue of national infrastructure. And when millions of these devices ship with terrible defaults, lack of patching and little oversight, they create a built-in mobilization tool for enemy botnets. That is when the battle space has already extended into the home network.

That is why secure-by-default standards are not an optional regulatory improvement but will be the minimum requirement for sale of connected devices in allied markets. If vendors can offload security costs onto users, they will do so. And the outcome is foregone: low-cost devices to buy, high-cost devices to protect and simple to militarize. The password, automatic updates, or hardened configurations should be forced and not just a marketing style option.

Defense only is a slow process. Allied states require botnet preemption, the ability to disrupt malicious infrastructure before it is used against hospitals, energy systems, research networks or government agencies in a manner that is collected and orchestrated at the government level. Restraint is not waiting until the attack is underway; it is failure by design. What you want to do is raise the cost curve on an attacker, break their command systems into pieces, and deny them the scale they need.

And that pressure must also be directed to the people and entities enabling the violence. State-sanctioned cyber contractors are able to disguise the 10,000-mile distance, legal ambiguity and opaque finances between themselves and their governments by masking any reasonable accountability under ethical standards of clear law or express contract, including disclosing funding sources. Sanctions, indictments, asset freezes and banking isolation are not merely symbols; they are the secret to transferring deniability into liability. Any contractor benefiting from cyber aggression should be radioactive, along with its executives, payment channels and commercial cover.

All of this is not possible without real-time public-private fusion cells. Intelligence agencies may only have visibility of what is in the next two levels of column one, telecom providers only see what you can configure at that level for their frequency, cloud platforms track per container and network call, security practices vary. Enemy actors will continue to move faster than a bureaucracy can catch up to if those pieces are not immediately glued back together.

And finally, we must abandon the fiction that “private” cyber proxies are different from the states that fund, task or shelter them. A contractor is not rogue when it serves state interests strategically. It is an instrument of power. To pretend otherwise is to play into the hand of the attacker.

The QTFY operation was a tactical victory. And the second and deeper truth is even more chilling: The next global cyber-attack may already be sitting silently in someone’s front room, blinking green by the Wi-Fi router.

Fransiscus Nanga Roka

Faculty of Law University 17 August 1945 Surabaya and managing Partner Law Firm Victorious Indonesia