UnHacked - Cybersecurity Made Simple for Small Businesses

How Chinese Hackers Breached NASA and DHS Using Home Routers | UnHacked Ep. 101

UnHacked - Cybersecurity Made Simple for Small Businesses

Show Notes

Hosts: Justin Shelley - https://www.phoenixitadvisors.com/ Mario Zaki - https://www.mazteck.com/ Joshua Holloway - https://7thdi.com/ NASA, Homeland Security, and the DOJ were just hacked using smart fridges, routers, and Apple TVs turned into a botnet.

If a Chinese front company staffed by retired military hackers can breach federal agencies with seemingly unlimited security budgets, what chance does a small business have? That's the question Justin Shelley, Mario Zaki, and Josh Holloway tackle in episode 101 of UnHacked, and the answer is more reassuring than you'd think.

Justin, Mario, and Josh break down how a group called QTFY, operating through a front company called XJW, built a database of known, published vulnerabilities (not secret zero-days) by scanning over 2 million routers, firewalls, and devices in a single day. They then hijacked vulnerable home devices, thermostats, cheap Amazon modems, Apple TVs, turning them into a botnet used to disguise attack traffic as normal U.S. internet activity and bypass geo-blocking on China. The operation ran undetected for roughly eight years before a hospital got hit as collateral damage and the FBI finally traced it back and took down the network by seizing the hardcoded command domains. Here's the part that matters for you: this entire breach was built on things that basic cybersecurity hygiene would have stopped. Unpatched known vulnerabilities. Unmanaged home and IoT devices. No inventory of what's actually on the network. The guys connect this directly back to fundamentals covered in past episodes, patch management, shadow IT, firewall lifecycle, and the death of the network perimeter, and explain why the real failure in most breaches isn't a lack of resources. It's a lack of follow-through. What you'll learn: How hackers built a database of known, published vulnerabilities (CVEs) by scanning over 2 million devices in a single day, and why "known" doesn't mean "harmless" Why your home router, thermostat, or cheap Amazon modem could already be part of a botnet attacking someone else without your knowledge How the FBI actually shut the operation down by seizing the hackers' own command domains Why the real question isn't "can I spend money on this fix" but "what does it cost me if I don't," and how to calculate that number for your own business A real example of a company that could lose $5 million a day (up to $30 million on payroll days) from downtime, and why that number changes every security decision New episodes drop every week with real talk on cybersecurity, AI, and digital risk for business owners who don't have a national security budget. Subscribe so you don't miss the next one. If this episode made you wonder what's actually sitting unpatched on your network right now, that's exactly the conversation Phoenix IT Advisors has with business owners every day. Visit PhoenixITAdvisors.com to schedule a consult, or go to UnHackMyBusiness.com to use the free portal referenced in this episode to catalog your risks and build a plan. Links: Full episode: https://unhackmybusiness.com/episode/101 Free risk assessment portal: https://unhackmybusiness.com Phoenix IT Advisors: https://phoenixitadvisors.com Follow the show: @UnHackedPodcast

More from UnHacked - Cybersecurity Made Simple for Small Businesses

Oct 20, 2026

Hosts: Justin Shelley - https://www.phoenixitadvisors.com/ Mario Zaki - https://www.mazteck.com/ Joshua Holloway - https://7thdi.com/ A viral AI "skill" promising Apple's design secrets came loaded with keyloggers, prompt capture, and an API rug pull. Josh found it before it found him. Most people won't. In this episode of UnHacked, Justin Shelley, Mario Zaki, and Joshua Holloway go free-form on the week in AI, and the week was wild. A new open-source tool can reverse engineer nearly any software product, and Adobe's entire suite was replicated within days. Lawsuits are coming, but nobody knows the legal ground rules yet. Meanwhile, Josh walks through a real-world discovery: a popular AI skill shared to hundreds of thousands of followers contained embedded keyloggers, captured every prompt, and was built to pull API keys and ship them off. His team now runs every skill through NVIDIA's Skill Spectre sandbox before it touches a production system, and he explains how you can too.

Oct 13, 2026

Hosts: Justin Shelley - https://www.phoenixitadvisors.com/ Mario Zaki - https://www.mazteck.com/ Bryan Lachapelle - https://www.b4networks.ca/ Joshua Holloway - https://7thdi.com/ Should you host your own AI so sensitive client data never leaves your building? Five security pros weigh cost, risk, and trust.

Oct 6, 2026

Hosts: Justin Shelley - https://www.phoenixitadvisors.com/ Mario Zaki - https://www.mazteck.com/ Bryan Lachapelle - https://www.b4networks.ca/ Is AI taking jobs? Three IT owners say they're seeing slower hiring, not layoffs, and early-career workers feel it most. Justin Shelley, Bryan Lachapelle, and Mario Zaki have been getting heated feedback on their AI clips, mostly distrust and fear. In this episode they start with whether hardware-level AI containment is realistic (Bryan's concern: hardware can't be changed once it's built, and a flaw makes it obsolete), then get into what they're actually seeing in their own businesses. Mario hasn't let anyone go, but he's hiring fewer technicians than the one or two he used to add each year. Bryan knows law firms that aren't hiring another law clerk. Data centers are pulling construction workers away from housing, and employers still can't fill the openings.

Sep 29, 2026

Hosts: Justin Shelley - https://www.phoenixitadvisors.com/ Mario Zaki - https://www.mazteck.com/ Justin knows nothing about football. He's using AI to run his fantasy team anyway, and he's currently winning. That's just where this episode starts. After two weeks of warning listeners about AI risk, Justin Shelley and Mario Zaki flip the script this week to talk about how AI is actually making their lives better right now, no tinfoil hats required. Justin walks through how he joined a fantasy football league with zero knowledge of the game, screenshots his lineup into AI every week for instructions, and is sitting in second place for points with the best playoff odds in his league heading into week three. Mario shares how he used AI to build a complete website and backend booking system for his family's shore house rental in under a week, including e-signature contracts, automated text messaging, and tenant management tools that used to require hiring a developer. The two also dig into how AI is changing IT troubleshooting, cutting down the need to memorize thousand-page technical manuals and speeding up how fast MSPs can actually solve problems for clients. From there, the conversation moves into where AI is headed next: full self-driving cars people already trust with daily commutes, at-home robots for chores nobody wants to do, and AI-assisted diagnostics that could catch cancer and other diseases before symptoms ever show up. Justin closes with his honest take on the "AI is coming for our jobs" fear, and why he believes automation elevates workers into better work instead of leaving them behind.

Sep 22, 2026

Hosts: Justin Shelley - https://www.phoenixitadvisors.com/ Mario Zaki - https://www.mazteck.com/ Joshua Holloway - https://7thdi.com/ One AI tool's price jumped from a fair quote to 10x more overnight. Is AI fear-mongering designed to keep you locked in? Every week there's a new AI headline promising the end of the world. Models "escaping" sandboxes, CEOs quitting to warn everyone AI is too dangerous, calls to slow down before it's too late. Justin Shelley, Mario Zaki, and Josh Holloway put their tinfoil hats on for episode 104 and ask the question nobody in the AI industry wants to answer: who actually benefits from all of this fear? The conversation gets real fast. Justin shares a tool he's been using where the base price stayed reasonable, but the AI component quietly went from a quoted price to 1,000% more once it left beta. Josh breaks down how AI-driven demand has tripled server prices in under a year and stretched lead times from days to months, and shares a story about a client who was sold an 8-year-old server as brand new. Mario explains why bringing AI models in-house still doesn't pencil out financially for most small businesses, even though the appetite to escape subscription pricing is growing fast. The theory they land on: the same companies telling you AI is too powerful to control might also be the ones most threatened by you running it yourself. If self-hosted, open-source AI models let businesses skip the subscription treadmill, then scaring the public into demanding regulation is a convenient way to make sure that option quietly disappears. Whether you buy the conspiracy or not, this episode will change how you read the next AI doom headline. What you'll learn: Why the "we need to slow down AI development" argument falls apart the moment you follow the money How one AI vendor's price jumped from a reasonable quote to 1,000% more once it left beta The real story of a client sold an 8-year-old server as "brand new," and how to make sure your IT provider never does that to you Why AI-capable server prices have tripled in under a year, with lead times stretching from days to months The theory that scary AI headlines are less about safety and more about keeping businesses locked into subscriptions instead of running AI in-house New episodes drop every week with real, unfiltered conversations about the technology and security decisions actually affecting small business owners. Subscribe so you don't miss the next one. Worried about where your data lives, who controls it, and what happens if a vendor you rely on gets breached or jacks up their prices? That's exactly the kind of risk Phoenix IT Advisors helps small businesses get in front of. Visit PhoenixITAdvisors.com to schedule a consult and find out where your business actually stands.

See all episodes →