NCSC Warns China linked Hackers Use Router Botnets for Covert Ops

The advisory from the National Cyber Security Centre (NCSC-UK) and international partners highlights a significant shift in the tactics of China-nexus cyber actors, who are increasingly using large-scale networks of compromised devices (covert networks) for cyber activities. These networks often comprise compromised Small Office Home Office (SOHO) routers and IoT devices, allowing attackers to obfuscate their origins and execute various phases of cyber attacks.

The advisory provides protective measures for organizations to defend against such threats. Recommendations include mapping network edge devices, implementing multi-factor authentication, and utilizing dynamic threat feeds. The document also outlines the structure of covert networks and emphasizes the growing risk posed by these botnet-style infrastructures.