cyber.hendryadrian.com
Security News · cyberscoop.com

Allied Agencies Warn of China-Linked Covert Networks Built from Compromised Devices

· Original article ↗

Summary

U.S. and allied agencies warn that China-linked actors are using evolving networks of compromised SOHO routers, IoT and smart devices for reconnaissance, malware delivery and espionage, and recommend hunting, network mapping and blocklists.

Key points

  • The advisory describes a shift from individually procured infrastructure to large-scale networks of compromised devices.
  • The networks mainly use SOHO routers, IoT and smart devices, are continually updated, and may be shared by multiple actors.
  • Agencies say the networks provide low-cost, deniable infrastructure for reconnaissance, malware delivery and information theft.
  • The advisory cites Volt Typhoon activity involving pre-positioning on U.S. critical infrastructure and Flax Typhoon espionage.
  • Raptor Train is cited as an example; the article says the botnet infected 200,000 devices worldwide.
  • For large and at-risk organizations, recommendations include active hunting, tracking and mapping networks, and using threat reporting to create blocklists.

Article Details

Event Type
U.S. and allied agencies issued an advisory warning of a shift by China-linked cyber actors toward large covert networks of compromised devices.
Impact
The advisory says these networks, mainly composed of compromised SOHO routers, IoT, and smart devices, provide low-cost, deniable infrastructure for reconnaissance, malware delivery, espionage, and information theft. It cites the Raptor Train botnet, which infected 200,000 devices worldwide, and activity attributed to Volt Typhoon and Flax Typhoon.

People

Nick AndersenCISA Acting Director who described the advisory’s purpose and the use of evolving covert networks by Chinese state-sponsored cyber actors.Richard HorneNCSC CEO who commented on the sophistication of China’s intelligence and military agencies’ cyber operations.

Threat Actors

Flax TyphoonThe advisory cites activity attributed to the group to conduct cyber espionage using covert networks.Volt TyphoonThe advisory cites activity attributed to the group to pre-position on U.S. critical infrastructure using covert networks.

Countries

Chinathe past few years there has been a major shift in the tactics, techniques and procedures (TTPs) used by China-nexus cyber actors, moving away from the use of individually procured infrastructure, and towards the use

Industries

Critical infrastructurecritical infrastructure, and Flax Typhoon to conduct cyber espionage.

Related Articles