August 27 Security Briefing: QTFY, Ubiquiti, and Chrome 152

Today’s Security Priorities

The August 27 briefing is about two connected questions: how operators hide attack infrastructure, and how quickly defenders can close exposed management and browser surfaces. The U.S. Department of Justice and FBI announced court-authorized seizures of core domains used by QScan and QTRouter, two complementary platforms operated by the China-linked QTFY group. A joint FBI, NSA and Cyber National Mission Force advisory explains how automated exploitation, compromised IoT devices and a distributed proxy network worked as one service.

On the product side, Ubiquiti published three CVSS 10.0 vulnerabilities affecting UniFi Protect, UniFi OS Server and UniFi Talk. Google also began rolling Chrome 152 to Android with the same security fixes as the desktop release. The shared operational task is to identify exposed systems first, verify the installed version on the actual application or device, and review sessions and access records from before the update.

These issues sit at different layers. QTFY demonstrates an adversary’s scanning and traffic-obfuscation pipeline. Ubiquiti shows how a management platform can become an entry point. Chrome 152 addresses a broad set of memory-safety and validation defects in the browser used by most employees. Treating edge infrastructure, management services and endpoints as separate workstreams makes the response faster and easier to verify.

At a Glance

• QTFY: QScan searched for and exploited vulnerable IoT devices and internet-facing services. QTRouter blended compromised devices with commercial proxies and virtual servers to make intrusion traffic appear local. Seizing hard-coded domains disrupted communication and authentication for both platforms.
• Ubiquiti: CVE-2026-77537 is a command-injection flaw in UniFi Protect, CVE-2026-77550 is a CRLF-based authentication bypass in UniFi OS Server, and CVE-2026-77554 is a command-injection flaw in UniFi Talk. The maximum scores reflect network-reachable paths with no required privileges or user interaction.
• Chrome 152: The desktop release contains 327 security fixes, and Android 152.0.7977.64 receives the same security set. Ten Critical issues cover use-after-free, uninitialized data and input-validation defects across ANGLE, Aura, Chromecast, Views, Safe Browsing and mobile components.

Indicator Trend

The QTFY advisory separates file indicators and infrastructure indicators into two CSV releases. Infrastructure entries are grouped by QTRouter, proxy-management systems, proxy pools and QScan, with first-seen and last-seen dates or an active status. Examples include jump.qt-proxy[.]org and securelink.qtproxy[.]xyz for QTRouter, and 154.64.238[.]222 and 154.64.238[.]247 for QScan.

Defenders should use the data for retrospective searches across DNS, proxy, firewall, VPN and EDR logs before turning it into a blanket block list. The release combines historical indicators dating back to 2017 with active infrastructure, so asset role, observation time and connection direction are essential context. A match on an edge device should trigger checks for firmware state, management accounts and any session that crossed into critical internal networks.

QTFY: QScan and QTRouter Disruption

QTFY is described as a China-linked group associated with Nanjing Xinjiuwei Network Technology, established in 2018. The joint advisory maps an integrated system: QScan for vulnerability discovery and exploitation, QTRouter for traffic obfuscation, and multiple botnet-management platforms for compromised IoT devices. QScan handled web scraping, TLS-certificate collection, subdomain enumeration and penetration tasks. It was built around a database of more than 200 Python proof-of-concept exploits and processed more than two million scanning and penetration tasks on a single day in 2024.

The flow has four stages. QScan first sweeps public services and edge devices using zero-day and known vulnerabilities. Vulnerable IoT equipment is then enrolled as botnet nodes. QTRouter blends those devices with commercial proxy services and leased virtual private servers, chaining nodes so traffic from China resembles a nearby legitimate user. Web shells, remote-access trojans and stolen legitimate credentials support persistence inside selected networks.

The published timeline includes exploitation of Pulse Secure, Fortinet FortiOS SSL VPN, Citrix ADC and Gateway, ProxyLogon, F5 BIG-IP, Log4Shell, Atlassian Confluence, Check Point Quantum Gateway, Ivanti CSA, CrushFTP and BeyondTrust Remote Support vulnerabilities. A 2024 Check Point campaign exfiltrated data from more than 300 organizations in the United States and abroad. In February 2026, QScan used a BeyondTrust RS vulnerability against a U.S. state government and also targeted a water district. The strategic issue is the operating model: new vulnerabilities can be combined quickly with years of scan data and a ready-made proxy mesh.

The seized domains were hard-coded into QScan and QTRouter for essential communication and authentication, making the two platforms inoperable. Defenders still need to examine artifacts created before the disruption, including web shells, remote tools, stolen accounts and infected IoT nodes. Review administrator logs on edge systems, new credentials and keys, unusual successful authentication, and remote sessions into critical networks rather than treating the domain seizure as complete cleanup.

1. Reconcile VPN, firewall, router and remote-support inventory with external scan results, then apply current software and firmware.
2. Reduce direct management paths between edge devices and critical systems; route administration through controlled jump hosts with multifactor authentication.
3. Hunt the official CSV indicators across DNS, proxy, firewall and EDR data, then investigate accounts, sessions, web shells and remote tools around any match.

Ubiquiti: Three CVSS 10.0 Vulnerabilities

Ubiquiti Security Advisory Bulletin 067 covers a broader set of UniFi security issues. Three received CVSS 10.0 scores and deserve first priority because they cross authentication or host command-execution boundaries from the network. CVE-2026-77537 is improper input validation in UniFi Protect that can lead to command injection on the host. CVE-2026-77550 is CRLF injection in UniFi OS Server that can bypass authentication. CVE-2026-77554 is improper input validation in UniFi Talk that can also result in command injection.

The minimum fixed releases differ by product: UniFi Protect Application 7.2.105 or later, UniFi OS Server 5.1.37 or later, and UniFi Talk Application 5.3.2 or later. Verify each application and server version independently even when a central console reports automatic updates. In environments that combine cameras, gateways and voice services, a successful update on one component is not evidence that the entire product stack is complete.

Use a four-step sequence: exposure review, change preparation, update and validation. Remove unnecessary public access to management interfaces and APIs, or place them behind a managed VPN and firewall policy. Back up configuration before the maintenance window, apply the product-specific fixed version, then test recording and alerts, gateway policies, phone registration and outbound calling. Finally, review pre-update administrator logins, new accounts, session tokens, unexpected processes and outbound connections.

Chrome 152: Desktop and Android Security Rollout

Google released Chrome 152 stable as 152.0.7977.64/.65 for Windows and macOS and 152.0.7977.64 for Linux, followed by Android 152.0.7977.64 with the same security fixes. The desktop package contains 327 security fixes. The ten publicly listed Critical issues include use-after-free, uninitialized-variable and input-validation defects in ANGLE, Aura, Chromecast, Views, Safe Browsing and mobile components.

A browser update is not complete when the package is merely downloaded. Existing processes can keep the older binary in memory, so users need a restart window and administrators need to verify the running version. Windows and macOS may show .64 or .65, while Linux and Android use .64. Browser-based VDI, kiosks and automation endpoints often restart later than ordinary workstations and should be tracked as a separate deployment group.

Several issues in this release affect ANGLE and other graphics or rendering components. Because web content passes through the renderer, sandbox and GPU process, deployment gaps are difficult to detect from a single console status. Check automatic-update policy, restart-pending devices, channel exceptions, pinned versions and managed Google Play status for Android work profiles. Secure web gateways and EDR can add detection, but they cannot replace the patched browser binary.

Operational Checklist

• Now: identify internet-exposed VPNs, routers and UniFi management interfaces, then compare recent connections with the official QTFY indicators.
• Today: verify UniFi Protect 7.2.105+, UniFi OS Server 5.1.37+ and UniFi Talk 5.3.2+ separately.
• Today: isolate restart-pending Chrome endpoints and verify running versions across Windows, macOS, Linux and Android.
• Within 24 hours: review management paths from edge devices into critical networks, new accounts, unusual sessions, remote tools and web-shell artifacts.
• Ongoing: connect internet-exposure inventory to patch prioritization and return DNS, proxy and EDR hunt results to the asset owner.

Sources

• U.S. Department of Justice — Justice Department and FBI Seize Platforms Operated and Used by China State-Sponsored Hackers: https://www.justice.gov/opa/pr/justice-department-and-fbi-seize-platforms-operated-and-used-china-state-sponsored-hackers
• FBI, NSA and CNMF — China-Linked Hacking Group QTFY Targets Military and Critical Infrastructure with Malicious Distributed Systems: https://www.ic3.gov/CSA/2026/260826.pdf
• Ubiquiti — Security Advisory Bulletin 067: https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9
• Google Chrome Releases — Stable Channel Update for Desktop: https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html
• Google Chrome Releases — Chrome for Android Update: https://chromereleases.googleblog.com/2026/08/chrome-for-android-update_01012845874.html