The middlemen of cyber espionage. [Research Saturday]

Dave Bittner speaks with Damon Rouse of Lumen Black Lotus Labs about "The Infrastructure Quartermaster," a China-linked enablement model that sells reusable proxy, router, and scanning infrastructure. CIOs should care because the research shows how commercial VPNs, VPSs, and home/IoT devices are repurposed to hide attribution, target enterprise perimeters, and support multiple threat actors.

Key points

• A "quartermaster" is an entity that builds and maintains infrastructure other actors use operationally.
• QTRouter, QTProxy, FastLabyrinth, and QScan formed a modular access and scanning ecosystem.
• The group rotated VPS providers roughly monthly and used backend servers to collect scan results.
• Targets included dual-use tech, government, biotech, healthcare, ISPs, telcos, universities, and MSPs.
• Defenders need strong baselines for normal traffic; remote work and SOHO devices can hide malicious access.
• Shared infrastructure improves attacker efficiency but also creates a takedown and monitoring choke point.