On August 26th the FBI, NSA and US Cyber National Mission Force published joint advisory JCSA-20260826-01 on a China-linked group tracked as QTFY. It is marked TLP:CLEAR and is freely available in full. Everything attributed below is the advisory's finding, not ours — we are reporting on a public government document, and we did not independently verify its attribution.
We are writing about it because one detail in it speaks directly to how URL scanning works, and because we checked our own data against it and found nothing. Both halves are worth saying.
