cyber.hendryadrian.com
Security News · keplernewsletter.substack.com

Privacy and Cybersecurity Roundup Covers EU Data Rules, AI Governance and China-Linked Networks

· Original article ↗

Summary

A 2026 roundup covers ENISA's cybersecurity technology-radar method, proposed biometric data-sharing, UK cross-domain guidance, privacy and AI rules, and an allied warning about China-linked covert networks of compromised devices.

Key points

  • ENISA published a six-stage methodology for identifying, assessing, and monitoring emerging cybersecurity technologies through its Technology and Innovation Radar.
  • The EU and US are negotiating a framework that could enable US authorities to check EU national databases, including biometric data; the agreement would require approval by the European Parliament and Council.
  • Updated UK NCSC guidance calls for end-to-end cross-domain security, with trust zones, staged data validation, controlled exports, component isolation, and observability.
  • A joint NCSC and allied-agency advisory describes China-nexus actors' use of distributed networks of compromised routers and IoT devices for operations including reconnaissance and exfiltration.
  • The advisory says the Raptor Train botnet infected more than 200,000 devices and warns that rapid endpoint rotation weakens reliance on static IP blocklists.
  • The Dutch DPA proposed practical guidance for explaining automated decisions, while Spain's AEPD outlined GDPR responsibilities for AI transcription, including accuracy, access, transparency, and consent.
  • US federal privacy bills and state measures described in the roundup address consumer data rights, sensitive data, safeguards, and limits on data use.

Article Details

Event Type
Joint cybersecurity advisory on China-linked threat actors’ use of covert networks of compromised devices
Impact
The advisory describes compromised routers and other internet-connected devices being used for espionage, pre-positioning, reconnaissance, malware delivery, command-and-control, and data exfiltration. Multi-hop routing through rotating devices can obscure attack origins, complicate attribution, and reduce the effectiveness of static IP blocklists.

MITRE ATT&CK

T1090.003 · Multi-hop ProxyThe advisory describes multi-hop proxying through compromised devices, with entry, traversal, and exit nodes routing traffic toward targets.

Threat Actors

Flax TyphoonThe advisory says Flax Typhoon leveraged similar covert network infrastructure for cyber espionage.Volt TyphoonThe advisory says Volt Typhoon used covert networks to pre-position capabilities within critical infrastructure.

Malware

Raptor TrainThe advisory notes that a single botnet (“Raptor Train”) infected over 200,000 devices globally, and that some networks are maintained by commercial entities linked to Chinese information security firms.

Countries

ChinaCovert Networks of Compromised Devices: NCSC and Allies Warn of Scaled China-Linked Cyber Operations

Industries

Critical infrastructureThese networks are now a central component of espionage and pre-positioning activities targeting critical infrastructure and other high-value sectors.

Related Articles