Article
What the agencies announced
On Aug. 26, the FBI and Justice Department said they had disrupted QTFY, also known as QT and QTCYBER. A joint advisory from the FBI, the National Security Agency and the Cyber National Mission Force ties the group to a Nanjing company founded in 2018 and describes it as part of a network of hackers for hire working alongside Chinese government entities. Its targets have included hospitals and health systems, government, communications, energy, information technology and water utilities.
The group built and sold hacking tools, traded exploits in freelance markets and maintained a network of infected internet-connected devices that it used to disguise attacks. The advisory says the group compromised routers running custom software, other connected devices, and edge appliances such as VPNs and remote access tools. In one 2024 campaign, data was taken from more than 300 organizations.
Why the edge is the weak point
Hijacked home and office routers let attackers route traffic through ordinary-looking addresses, which makes intrusions harder to spot. Unpatched VPN and remote access appliances are a common way in. AHA cybersecurity adviser John Riggi warned that the line between criminal groups and hostile intelligence services is blurring, and that securing these everyday devices has never been more urgent.
Hospitals carry more of this exposure than many organizations. Remote clinicians, vendors with remote support access, telehealth, and aging devices in clinics and outpatient sites all widen the edge that must be defended.
What leaders should ask for
- Inventory. A complete list of internet-facing devices and remote access tools, including those managed by vendors.
- Lifecycle plan. Patch status for each, automatic updates where possible, and dates to replace end-of-support equipment.
- Segmentation. Proof that critical clinical and operational systems are not directly reachable from edge devices.
- Threat hunting. A search of network logs for the indicators the agencies published, with results reported to leadership.
- Exposed secrets. A review of public websites and apps for published keys, tokens or configuration details.
The advisory also lays out response steps: isolate affected hosts, scope the intrusion, report to the FBI and harden the network against a return. Make sure your incident plan already reflects them.
Archive entry for Sep 2, 2026, added Nov. 11, 2026.