NCSC Warns China-Linked Actors Use Botnets of Compromised Edge Devices
Summary
The NCSC and partners warn that China-linked actors use covert networks built from compromised SOHO routers and IoT devices. Their advisory recommends baselining edge-device traffic, monitoring remote access, and filtering against known indicators.
Key points
- The NCSC says China-nexus groups increasingly rely on covert networks and botnets built from compromised SOHO routers, IoT devices, and other edge devices.
- The NCSC and partner agencies issued a joint advisory with guidance for organizations of all sizes.
- The advisory recommends mapping and baselining edge-device traffic, especially VPN and remote-access connections.
- Organizations are urged to use dynamic threat-feed filtering that includes known covert-network indicators.
- According to the NCSC, networks can be shared by multiple groups and change as devices, software, and exploits change.
- The article says Integrity Technology Group was called out for managing a botnet used by Flax Typhoon and was later sanctioned by the EU Council over its role in cyberattacks involving more than 65,000 devices across six EU member states.
Article Details
- Event Type
- Joint advisory warning about China-linked cyber actors’ use of covert networks built from compromised edge devices.
- Impact
- The networks use compromised SOHO routers, IoT, and other smart devices to conceal malicious activity. The article reports that a botnet controlled and managed by Integrity Technology Group was used by Flax Typhoon and compromised more than 65,000 devices across six EU member states; the EU Council later sanctioned the company for its role in cyberattacks.