NCSC Advises Organizations on Defending Against China-Nexus Covert Device Networks
Summary
The NCSC and partner agencies advise organizations to map and baseline edge-device traffic and use adaptive defenses against China-nexus actors’ changing networks of compromised routers and other devices.
Key points
- China-nexus actors use networks of compromised routers and other edge devices for reconnaissance, malware delivery, command and control, and data exfiltration.
- The networks can be rapidly reshaped, making static IP block lists less effective and causing indicators of compromise to quickly become outdated.
- The NCSC and partner agencies published guidance for small, medium, and large organizations.
- Organizations should map and baseline edge-device traffic, especially VPN and remote-access connections, and use dynamic threat-feed filtering.
- Recommended remote-access protections include two-factor authentication and, where possible, zero-trust controls, IP allow lists, and machine-certificate verification.
- Larger or high-risk organizations are advised to consider hunting suspicious SOHO/IoT traffic, geographic profiling, and machine-learning-based anomaly detection.
Article Details
- Defense Focus
- Defend against China-nexus covert networks of compromised routers and other edge devices by replacing reliance on static indicators with adaptive, intelligence-driven defenses.
- Detection Methods
- Map and baseline edge-device traffic, especially VPN and remote-access connections.
- Hunt for suspicious SOHO/IoT traffic.
- Use geographic profiling and machine-learning-based anomaly detection, particularly for larger or high-risk entities.
- Data Sources
- Edge-device network traffic, including VPN and remote-access connections
- SOHO/IoT traffic
- Rule Types
- Dynamic threat-feed filtering using known covert-network indicators
- IP allow lists
- Defensive Actions
- Map and baseline edge-device traffic.
- Adopt dynamic threat-feed filtering that includes known covert-network indicators.
- Implement two-factor authentication for remote access.
- Apply zero-trust controls and machine-certificate verification where possible.
- Consider active hunting, geographic profiling, and machine-learning-based anomaly detection for larger or high-risk entities.