cyber.hendryadrian.com
Security News · bleepingcomputer.com

UK Warns China-Nexus Actors Are Using Hijacked-Device Proxy Networks

· Original article ↗

Summary

The UK NCSC and partners warn that China-nexus actors increasingly route operations through botnets of hijacked SOHO routers and IoT devices. The advisory cites Raptor Train and KV-Botnet and recommends MFA, dynamic threat feeds, allowlisting and zero-trust controls.

Key points

  • A joint advisory says China-nexus threat actors increasingly use continually updated networks of compromised SOHO routers and IoT devices to route operations through proxy chains.
  • Raptor Train infected more than 260,000 devices worldwide in 2024; the FBI linked it to activity attributed to Flax Typhoon and Integrity Technology Group.
  • The FBI disrupted Raptor Train in September 2024 with help from Black Lotus Labs; the advisory says its campaigns targeted sectors including government, telecommunications and defense.
  • KV-Botnet, used by Volt Typhoon, consisted mainly of outdated Cisco and Netgear routers. The FBI wiped malware from infected routers in January 2024, and revival attempts were observed later that year.
  • The agencies warn that blocking static malicious IP lists is less effective as compromised proxy nodes change, and recommend MFA, mapping edge devices, dynamic threat feeds, IP allowlists, zero-trust controls and machine-certificate verification.

Article Details

Event Type
Joint cybersecurity advisory warning that China-nexus threat actors are using proxy networks of hijacked consumer devices to evade detection.
Impact
Compromised SOHO routers and other connected devices can relay traffic through multiple nodes, making static IP-based defenses less effective and creating potential for large-scale cyberattacks. Raptor Train infected more than 260,000 devices worldwide in 2024. The FBI disrupted Raptor Train in September 2024 and KV-Botnet in January 2024; the article reports that Volt Typhoon later attempted to revive KV-Botnet. Reported target sectors included military, government, higher education, telecommunications, defense industrial base, and IT.

MITRE ATT&CK

T1090 · ProxyThe advisory describes threat actors routing traffic through chains of compromised devices to disguise activity and evade detection, consistent with use of network proxies.

People

Paul ChichesterNCSC-UK Director of Operations who warned that botnet operations pose a significant threat to the UK.

Threat Actors

Flax TyphoonThe FBI linked Raptor Train to malicious activity attributed to Flax Typhoon; the article describes the group as Chinese state-sponsored.Volt TyphoonThe article says KV-Botnet was used by the Chinese state-backed group and reports that it began trying to revive the botnet in November 2024 after an earlier failed attempt.

Vendors

CiscoKV‑Botnet exploited outdated Cisco and Netgear routers and was disrupted by the FBI, though revival attempts were observed.NETGEARKV‑Botnet exploited outdated Cisco and Netgear routers and was disrupted by the FBI, though revival attempts were observed.

Countries

ChinaThe United Kingdom’s National Cyber Security Centre (NCSC-UK) and international partners warned that China-nexus hackers are increasingly using large-scale proxy networks of hijacked consumer devices to evade detectionTaiwanand Taiwan.United KingdomThe United Kingdom’s National Cyber Security Centre (NCSC-UK) and international partners warned that China-nexus hackers are increasingly using large-scale proxy networks of hijacked consumer devices to evade detectionUnited StatesThis joint advisory, co-signed by agencies from the United States, Australia, Canada, Germany, Japan, the Netherlands, New Zealand, Spain, and Sweden, says the majority of Chinese hacking groups have switched from

Industries

Defense industrial basecampaigns targeting entities in the military, government, higher education, telecommunications, defense industrial base (DIB), and IT sectors, primarily in the U.S.Governmentfrom researchers at Black Lotus Labs after linking it to campaigns targeting entities in the military, government, higher education, telecommunications, defense industrial base (DIB), and IT sectors, primarily in theHigher Educationat Black Lotus Labs after linking it to campaigns targeting entities in the military, government, higher education, telecommunications, defense industrial base (DIB), and IT sectors, primarily in the U.S.Militarywith help from researchers at Black Lotus Labs after linking it to campaigns targeting entities in the military, government, higher education, telecommunications, defense industrial base (DIB), and IT sectors,Telecommunicationsafter linking it to campaigns targeting entities in the military, government, higher education, telecommunications, defense industrial base (DIB), and IT sectors, primarily in the U.S.

Related Articles