China-Linked Hackers Exploit Everyday Devices in Global Espionage Campaign The UK’s National Cyber Security Centre (NCSC), alongside cybersecurity agencies from nine other countries including the U.S., Australia, Canada, and Germany has issued a warning about a sophisticated cyber-espionage campaign tied to China. The threat involves the hijacking of common internet-connected devices, such as Wi-Fi routers, printers, and webcams, to create covert networks (or "botnets") for surveillance and data theft. These botnets primarily target outdated or unpatched devices, using them as launchpads for attacks while obscuring the attackers' origins. The NCSC’s CEO, Richard Horne, described China’s cyber capabilities as "eye-watering," emphasizing that Beijing’s intelligence and military agencies now operate as a "peer competitor" in cyberspace. The shift in tactics leveraging compromised consumer and small office devices marks a significant evolution in China-linked cyber operations. The advisory highlights that these covert networks are often maintained by private Chinese firms, with one example involving a company that infected 200,000 devices worldwide. A notable group, Volt Typhoon, has been linked to infiltrations of critical U.S. infrastructure, including rail, aviation, and water systems. The NCSC warns that multiple threat actors may share a single botnet, making attribution and defense more challenging. To mitigate risks, the NCSC recommends organizations map their IT systems including connections to consumer broadband networks enforce multi-factor authentication for remote access, and restrict external device connections. While the guidance is aimed at businesses, the widespread use of compromised household devices underscores the broader threat landscape. Earlier this year, Google disrupted a similar "residential proxy" network, demonstrating the global scale of these operations. The NCSC’s advisory, published on Thursday, confirms that China-backed hackers continue to refine their methods, posing a persistent and evolving risk to cybersecurity.

Global Cybersecurity Agencies Warn of Shift in Chinese Hacker Tactics A coalition of U.S. and international cybersecurity agencies including the U.K.’s National Cyber Security Centre (NCSC), CISA, the NSA, FBI, and counterparts from Australia, Canada, Germany, the Netherlands, New Zealand, Japan, Spain, and Sweden issued a joint advisory on Thursday highlighting a significant evolution in Chinese state-sponsored cyber operations. The warning details a "widespread shift" in tactics, with Chinese hackers increasingly relying on large-scale, covert networks of compromised devices to conduct attacks. These networks, often built from hijacked Small Office/Home Office (SOHO) routers, IoT devices, and smart hardware, allow threat actors to obscure their origins, reduce costs, and evade attribution. Evidence suggests Chinese information security firms play a role in creating and maintaining these infrastructures. The networks are used for a range of malicious activities, including reconnaissance, malware deployment, and data exfiltration. Notable examples include the Volt Typhoon group’s targeting of U.S. critical infrastructure and Flax Typhoon’s cyber espionage campaigns. One such network, Raptor Train, infected over 200,000 devices globally, demonstrating the scale and persistence of these operations. NCSC CEO Richard Horne described China’s cyber capabilities as "eye-watering" in sophistication, with multiple covert networks in constant development. While defenses are complex, the advisory recommends proactive measures such as threat hunting, network mapping, and the use of blocklists to mitigate risks. CISA Acting Director Nick Andersen emphasized the strategic nature of these networks, warning that Chinese state-sponsored actors are leveraging them at scale to threaten critical infrastructure. The advisory underscores the need for heightened vigilance as these tactics continue to evolve.