Hackers and AI: Lessons in cyber resilience from the ConnectWise attack
What does the targeting of NASA and US agencies reveal about enterprise security? Getronics’ Rob Nidschelm examines the lessons for exposed systems, threat detection and response.
Speak to an expert
A cyber campaign targeting major US institutions highlights a challenge for every enterprise: attackers can hide behind ordinary-looking internet traffic, while exposed systems give them opportunities to get inside.
Commenting in Cyber Magazine, Rob Nidschelm, Global Head of Operational Security at Getronics, explains why disrupting the attackers’ infrastructure is valuable—and why organisations still need to examine their own exposure.
What happened?
On 26 August 2026, the US Department of Justice and FBI announced the seizure of domains supporting two hacking platforms, QScan and QTRouter. US authorities linked the platforms to QTFY, a China-linked group targeting critical infrastructure and other sensitive networks.
The Department of Justice announcement names NASA, the Federal Reserve and several US government departments among the targets.
Being targeted does not necessarily mean an organisation was breached. Cyber Magazine reports successful intrusions at some institutions, while distinguishing these from the cited unsuccessful attempts against NASA and the US Senate.
How the attackers concealed their activity
The operation combined tools for finding vulnerable systems with infrastructure designed to conceal where attacks originated.
According to the joint security advisory announced by the NSA, QScan supported reconnaissance and exploitation, including attacks on vulnerable Internet of Things devices. QTRouter combined compromised devices with other infrastructure to make malicious activity blend in with legitimate traffic.
The advisory also provides a detailed account of an Ivanti vulnerability exploited by QTFY. The group used the vulnerability to gain access to exposed Ivanti Connect Secure appliances, deploy web shells and establish persistence. This illustrates how an internet-facing appliance can become an entry point for broader activity, particularly when patches are unavailable, delayed or not applied correctly.
For defenders, the practical implication is clear: an apparently familiar network location is not enough to establish that an activity is trustworthy.
Disruption gives defenders an opportunity
The domain seizures interrupted infrastructure the platforms depended on. Rob welcomes the disruption but cautions against treating it as a permanent end to the threat.
“The domain seizures represent a meaningful disruption because they removed shared infrastructure that could support multiple operators.”Rob Nidschelm
The response inside an organisation still matters. Security teams need to understand whether exposed systems were accessed, what historical evidence remains available and whether unsuccessful attempts reveal weaknesses that need attention.
Three actions for security teams
Action | What to check |
|---|---|
Prioritise exposed systems | Identify internet-facing appliances and services, confirm who owns them and review their update status. Prioritise actively exploited vulnerabilities and follow vendor guidance when compromise is suspected. |
Review historical activity | Examine available logs for suspicious access, unusual connections and signs of earlier compromise. Use relevant threat intelligence to guide the investigation and identify gaps in the evidence. |
Investigate unsuccessful attempts | Review blocked or failed access attempts alongside confirmed incidents. Repeated attempts can reveal which systems attackers are probing and where additional investigation or protection is needed. |
These actions connect cyber threat intelligence with practical detection and response. Intelligence becomes more useful when teams can relate it to their own systems and act on what they find.
What should organisations take away?
A successful takedown does not establish that every affected environment is secure. Organisations still need to review exposure, investigate suspicious activity and confirm that security findings lead to action.
For security leaders, three questions provide a useful starting point:
- Do we know which internet-facing systems could provide an entry point?
- Can we investigate activity that happened before the latest alert?
- Who owns the decision to investigate, contain and remediate?
Read the full Cyber Magazine article for more detail on the campaign and Rob’s perspective.
About the author
Rob Nidschelm
Global Head of Operational Security
Rob Nidschelm leads Getronics’ global operational security teams, covering security operations, identity and privileged access management, threat intelligence, security engineering and incident response. Working in cybersecurity since 2005, he helps organisations connect security strategy with practical controls, clear accountability and operational resilience.
www.linkedin.com/in/robnid/
