The middlemen of cyber espionage. [Research Saturday]

Host Dave Bittner introduces Damon Rouse of Lumen’s Black Lotus Labs and the research, “The Infrastructure Quartermaster: Inside a China Nexus State Enablement Model.” Rouse explains that the investigation began through an existing personal and professional relationship with a San Diego FBI national-security agent. Before joining Lumen, Rouse had worked in network defense at San Diego-area defense contractors, including Viasat, where he dealt with Chinese adversaries and met FBI personnel involved in victim notifications and investigations. When Rouse moved to Black Lotus Labs, the agent—who had been working the case since 2018—asked whether Lumen could use its visibility to investigate a problem that had stalled. Rouse says this happened almost immediately, around his second day at the new job, with Mike Horka helping connect the relevant people. Bittner observes that the story is notable in an era focused on AI agents because it depends on human trust built over time. Rouse agrees, saying the research was developed in coordination with the FBI and the Joint Cyber Defense Collaborative. Government agencies and companies such as Google, Microsoft, Lumen, and Amazon can each do valuable work, he says, but public-private cooperation produces a stronger defense against nation-state adversaries.

Rouse defines a cyber “quartermaster” as an individual, company, or government entity that creates, maintains, and organizes infrastructure for other entities to use operationally. The investigated company provided products and services rather than acting as a conventional, single threat group. Its QT Router was a physical device with preconfigured access to QT Proxy infrastructure, which supplied the connections used by customers. QT Proxy, in turn, used what Black Lotus Labs called FastLabyrinth as an obfuscation layer. FastLabyrinth consisted of selected VPN nodes co-opted from a Chinese commercial VPN provider known as an “airport” service, a term associated with services that help users get around China’s Great Firewall. The particular service was FastLink.ws, and the researchers named the component FastLabyrinth because of the provider’s name and its role in the system. Rouse stresses that FastLabyrinth was only one possible proxy layer. The company had also built IoT botnets and operated or managed virtual private server infrastructure, giving it the ability to substitute different proxy and obfuscation mechanisms. The result was a modular, reusable service layer that could support several customers or threat actors.

While investigating backend servers associated with the provider, Black Lotus Labs observed roughly five or six nodes checking in approximately every five minutes. Analysts examined the nodes’ outbound traffic and found a distinctive scanning pattern. After sharing findings with the FBI and combining the two organizations’ observations, they assessed that the infrastructure was a highly tuned, distributed scanning system, which they called QScan. QScan used infrastructure from approximately four VPS providers and rotated the scanning nodes about once a month. Rouse says replacement intervals varied—sometimes around 26 days and sometimes around 35—but the average was monthly. The nodes scanned targets and reported results back to backend servers. Rouse says he can only speculate about what happened afterward, but the likely model was a large database containing scan results and discovered vulnerabilities, with vulnerabilities mapped to exploits held by the provider or its customers. The targeting reflected Chinese strategic interests. Researchers saw scanning against government and military infrastructure, dual-use technology, biotechnology and healthcare, universities, think tanks, ISPs, telecommunications providers, and internet-backbone companies. Healthcare-focused managed service providers and billing systems were especially notable, while routers and modems from vendors such as Netgear, Linksys, and Zyxel appeared to be scanned for possible future botnet or proxy-network use.

Bittner asks why the quartermaster’s purchase or co-option of commercial proxy infrastructure differed from more familiar attacker behavior. Rouse’s answer is operational efficiency. Chinese commercial VPN “airport” providers offer fast connections, low latency, and high availability, allowing the quartermaster to acquire or arrange access to ready-made nodes instead of building and maintaining every part of the network itself. Rouse says the relationship could take several forms: the quartermaster might simply pay for access, partner with the people operating the VPN company, or use its influence to insist that nodes be made available. In each case, the result is a low barrier to entry and a fast way to support multiple customers through the same obfuscation network. He compares these enablement companies to highly technical government contractors. The people behind the investigated QTFY company were described as highly skilled and well connected to Chinese government and intelligence circles, with some likely having prior government or military experience and strong connections to the People’s Liberation Army. Those relationships give them access that a small, ordinary company would not have. The quartermaster therefore was not merely renting random infrastructure; it was a well-resourced intermediary able to assemble flexible services for state-linked operations.

Because multiple actors can use the same proxy and scanning systems, Rouse says attribution becomes difficult. Traffic through FastLabyrinth can look similar across customers, and the same organization may be scanned in successive months by activity that differs only slightly. Net-flow patterns can reveal interests and operational changes, but they may not support high-confidence identification of a particular group. Rouse argues that this is why intelligence sharing matters. Public companies may have different telemetry from one another, while government and intelligence agencies have additional sources of visibility. Combining those perspectives can turn ambiguous overlap into a higher-fidelity attribution assessment. He says Black Lotus Labs and the FBI repeatedly informed one another: one side’s sharing revealed new infrastructure, while the other side’s analysis helped expand the investigation. The shared model also creates a defensive choke point. Monitoring one network can expose activity from several customers, and taking down one enabling service can disrupt multiple operations at once. Rouse calls this a “dual-edged” advantage: infrastructure removal can have real-world effects, but the operators are capable of pivoting rapidly to new VPS providers, botnets, or proxy networks. The FBI, not Black Lotus Labs, determines law-enforcement actions; Rouse’s role was to help build the strongest possible case.

Rouse’s main recommendation is for enterprise defenders to establish a reliable baseline of legitimate traffic entering perimeter devices and flowing into the security operations center. Organizations should understand where employees are, what normal connections look like, and how users legitimately reach VPN and other perimeter infrastructure. Without that baseline, suspicious traffic can blend into ordinary activity. He gives the example of an attacker compromising a small-office or home-office device belonging to someone in Nebraska. Traffic originating from a Comcast connection in Nebraska may look harmless in logs even when the device is being used to target another organization. This makes source reputation and country-based filtering insufficient. Rouse also says traditional geofencing is weak because the final egress point may be physically close to the victim and located in the country being targeted. The practical takeaway is to monitor behavior around perimeter devices and VPN infrastructure, not just IP addresses or geographic origin. Rouse connects this pattern to other research, including Raptor Train, where the final hop can appear to come from inside the target country. Defenders should reduce exposed attack surface and keep routers, firewalls, and IoT devices updated, while using their knowledge of normal traffic to identify connections that do not belong.