FBI, DOJ announce disruption of China-linked hacking group targeting hospitals, other critical infrastructure 

The FBI and the Department of Justice Aug. 26 announced the disruption of a China-linked hacking group known as QTFY. The group, which also identifies as QT and QTCYBER, has targeted hospitals and health systems, as well as government services and facilities, communications, energy, information technology, and water and wastewater systems. The agencies said QTFY, active since 2018, operates within a network of hackers-for-hire and government entities in the People’s Republic of China. A joint advisory (https://www.aha.org/system/files/media/file/2026/08/joint-cybersecurity-advisory-tlp-clear-china-linked-hacking-group-qtfy-targets-military-and-critical-infrastructure-with-malicious-distributed-systems-8-26-2026.pdf) released yesterday by the FBI, National Security Agency and the Cyber National Mission Force details tactics by the group. QTFY threat actors developed malicious hacking tools and have traded malware and exploits within freelance hacking networks — in addition to creating and maintaining a network of internet-connected devices with malware — designed for attacks on critical infrastructure organizations. 

“This serious China-based cyber threat once again demonstrates that the line between foreign criminal hacking groups, their infrastructure and hostile intelligence services is becoming increasingly blurred,” said John Riggi, AHA national advisor for cybersecurity and risk. “This threat also demonstrates how common internet-connected devices such as routers and security cameras in our homes and organizations can serve as a discreet platform for advanced cyber threat actors to mask their movements and penetrate our networks. The need to identify and secure these ubiquitous devices is greater than ever.”

For more information on this or other cyber and risk issues, contact Riggi, at jriggi@aha.org, or Scott Gee, AHA deputy national advisor for cybersecurity and risk, at sgee@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.