cyber.hendryadrian.com
Detection & Defense · cisa.gov

Agencies Urge Defenses Against China-Nexus Covert Networks of Compromised Devices

· Original article ↗

Summary

A joint advisory describes China-nexus actors’ use of dynamic networks of compromised routers and IoT devices, and recommends monitoring, access controls, and active hunting to defend against them.

Key points

  • The NCSC believes most China-nexus threat actors use large, dynamic networks of compromised SOHO routers and IoT devices.
  • Actors use these networks for reconnaissance, malware delivery, command and control, data exfiltration, and deniable browsing.
  • Raptor Train infected more than 200,000 devices worldwide in 2024; the advisory says it was managed by Integrity Technology Group.
  • The advisory says the KV Botnet used by Volt Typhoon was mainly composed of vulnerable, end-of-life Cisco and NetGear routers.
  • Because networks change and may serve multiple actors, static malicious-IP blocklists can be less effective.
  • Recommended steps include mapping edge devices, baselining connections, using dynamic threat feeds, and enabling multifactor authentication.
  • For higher-risk organizations, guidance includes VPN allow lists, zero-trust policies, machine certificates, active hunting, and NetFlow analysis.

Article Details

Defense Focus
Detect and defend against attacks routed through large, dynamic networks of compromised SOHO routers, IoT devices, and other edge devices.
Detection Methods
  • Baseline normal connections, particularly to corporate VPNs, and investigate unexpected connections from consumer broadband ranges.
  • Use dynamic threat feeds to identify covert-network infrastructure and hunt for connections from IP addresses likely to host compromised SOHO routers or IoT devices.
  • Analyze banners and certificates to track and map reported covert networks.
  • Use NetFlow to investigate upstream connections and identify new covert-network nodes.
  • Profile normal network-edge activity with machine-learning techniques to detect and block anomalies.
Data Sources
  • Network-edge device inventory and expected connection baselines
  • VPN and other remote-connection records, including source IP addresses
  • Dynamic threat feeds and threat reporting
  • Network banners and SSL certificates
  • NetFlow feeds
  • Incoming-connection attributes such as geography, operating system, time zone, and organization-specific system configuration
Platforms
  • Corporate VPNs
  • NetFlow
Defensive Actions
  • Map network-edge devices and document which systems should connect to them.
  • Use IP address allow lists for corporate VPN connections; consider geographic allow lists or connection profiles based on operating system, time zone, and organization-specific configuration.
  • Implement multifactor authentication for remote connections and zero-trust policies.
  • Enforce machine certificates for SSL connections and reduce the internet-facing presence of the IT estate.
  • Use dynamic blocklists and alert rules based on threat reporting and threat feeds rather than relying solely on static IOC blocklists.
  • Ask managed service or security providers to investigate when internal capability is insufficient.

MITRE ATT&CK

T1090.003 · Multi-hop ProxyChina-nexus actors route traffic through multiple compromised devices to obscure its origin.T1583.004 · ServerThe advisory says virtual private servers are used as on-ramps into covert networks.T1584.001 · DomainsThe advisory describes botnets as core components of covert networks that provide compromised infrastructure for routing and operations.T1584.002 · DNS ServerCompromised SOHO routers, firewalls, NAS devices, and other edge devices are enlisted as traversal or exit nodes in covert networks.

People

Paul ChichesterIdentified as NCSC Director of Operations and quoted on the threat posed by botnet operations exploiting vulnerable internet-connected devices.

Threat Actors

Flax TyphoonThe advisory says the FBI assessed Integrity Technology Group to be responsible for computer intrusion activities attributed to China-based hackers known as Flax Typhoon.Volt TyphoonThe advisory states that the KV Botnet was used by Volt Typhoon.

Vendors

CiscoEdge devices are often vulnerable because they are end-of-life or unpatched (e.g., Cisco and NetGear routers, web cameras, video recorders, NAS devices), allowing large-scale compromise.NETGEAREdge devices are often vulnerable because they are end-of-life or unpatched (e.g., Cisco and NetGear routers, web cameras, video recorders, NAS devices), allowing large-scale compromise.

Countries

ChinaChina-nexus cyber actors are increasingly using large, dynamic covert networks of compromised SOHO routers, IoT and edge devices to route, hide and scale malicious activity such as reconnaissance, malware delivery, C2

Industries

Digital infrastructureincluding those operating essential services, in sectors such as energy, healthcare, transport, digital infrastructure and government.  Energyunder the highest levels of threat, including those operating essential services, in sectors such as energy, healthcare, transport, digital infrastructure and government.  GovernmentTrack and map covert networks reported by industry or government by looking at banners and certificates.Healthcarethe highest levels of threat, including those operating essential services, in sectors such as energy, healthcare, transport, digital infrastructure and government.  Transportlevels of threat, including those operating essential services, in sectors such as energy, healthcare, transport, digital infrastructure and government.  

Related Articles