Issue: August 30, 2026

This week was light on genuinely new regulatory activity. The briefing covers one substantive story: the DOJ/FBI takedown of the QTFY-operated QScan and QTRouter IoT botnet platforms, which named HHS and NIH among their targets and bears directly on connected-device hygiene. The deadlines table also corrects two items prior issues got wrong: the IEC 62304 Edition 2 timeline (still at CD2 ballot, not FDIS — realistic publication is 2028-2029) and the EU AI Act high-risk deadlines (deferred via the Digital Omnibus to December 2027 and August 2028).

1. DOJ and FBI Seize China-Linked IoT Botnet Platforms Used to Target HHS, NIH, and Other Critical Infrastructure

On 26 August 2026, the Justice Department and FBI announced court-authorized domain seizures disabling two linked hacking platforms, “QScan” and “QTRouter,” operated by a PRC state-sponsored group tracked as QTFY (also known as QT or QTCYBER) and run out of Nanjing Xinjiuwei Network Technology Company. Unsealed court documents from the Southern District of California name the Department of Health and Human Services and the National Institutes of Health among the group’s targets, alongside NASA, the Federal Reserve, the Department of Energy, DOJ, and the U.S. Senate. The same day, the FBI and NSA published a joint cybersecurity advisory (available via ic3.gov) detailing QTFY indicators of compromise dating back to at least 2018.

How the platforms worked

According to the unsealed affidavit, QTFY sold hacking services — including to China’s Ministry of State Security and the People’s Liberation Army — built around two complementary tools. QScan is a vulnerability-scanning and exploitation platform that automatically finds and infects thousands of internet-connected devices worldwide, feeding them into QTRouter, a network of compromised IoT devices, commercial proxy services, and leased virtual private servers. QTRouter then functions as an “obfuscation network,” letting QTFY and other malicious actors route their intrusion traffic through devices outside China — sometimes local to the victim’s own network — to disguise the true origin of an attack. Because the seized domains were hard-coded into both tools for command-and-control and authentication, the takedown rendered QScan and QTRouter inoperable. The disruption follows a pattern of similar U.S. actions against PRC-linked IoT botnets, including 2023 and 2024 takedowns of infrastructure used by the Volt Typhoon and Flax Typhoon hacking groups.

Manufacturer relevance

This is a law-enforcement action against attacker infrastructure that indiscriminately recruits vulnerable, internet-facing IoT devices — a category that includes network-connected medical devices, gateways, and hospital-facility equipment. The joint FBI/NSA advisory’s mitigation guidance maps directly onto baseline device-security hygiene manufacturers are already expected to support: keeping device software and firmware current and patchable, avoiding hard-coded or shared default credentials that let scanners like QScan achieve automated compromise at scale, and enabling customers to isolate internet-facing components from a device’s safety-critical functions. Because QTFY has been recruiting devices since at least 2018, manufacturers with fielded products that are end-of-support, unpatched, or reachable from the open internet should treat this advisory as a prompt to check whether any of their device families appear in the published indicators of compromise, and to reinforce postmarket guidance to healthcare delivery organizations about network segmentation for connected devices.

Sources: Justice Department and FBI Seize Platforms Operated and Used by China State-Sponsored Hackers to Target U.S. Critical Infrastructure - U.S. Department of Justice, 26 August 2026; NSA and FBI issue warning about Chinese hacking group QTFY - Intelligence Community News, 27 August 2026