Threat reportAPTTL-2026-3861
China-Nexus Covert Networks of Compromised Edge Devices (SOHO Routers, IoT, NAS, Firewalls) Targeting Critical Sectors - Joint Advisory AA26-113A
China-Nexus Covert Networks of Compromised Edge Devices (TL-2026-3861), also tracked as China-nexus covert networks, is a high-severity advanced persistent threat campaign, first published 2026-10-19. It is linked to a China-nexus actor with high confidence, affects Various SOHO routers, maps to 5 MITRE ATT&CK techniques (T1090.003, T1583.003, T1584.005), and is covered by 9 detection rules and 12 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-3861
- Threat ID
- TL-2026-3861
- Also known as
- China-nexus covert networks, ORB networks (operational relay box networks), AA26-113A, KV Botnet, Raptor Train
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution confidence
- HIGH
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- critical infrastructure, government administration, telecoms, energy, water, transport, defense
- Target regions
- Global, North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 12
Malware and tooling in China-Nexus Covert Networks of Compromised Edge Devices
Malware and tooling: KV Botnet, Mirai, Nosedive, Raptor Train, Sparrow
How China-Nexus Covert Networks of Compromised Edge Devices works
On 23 April 2026 CISA, FBI, DC3, NSA, NCSC-UK and partner agencies from Australia, Canada, Germany, Japan, the Netherlands, New Zealand, Spain and Sweden published joint advisory AA26-113A on China-nexus actors operating large-scale covert networks built from compromised SOHO routers, IoT devices, firewalls and NAS devices. The networks obscure attribution and support reconnaissance, malware delivery, command-and-control and data exfiltration against critical sectors, and rapidly rotating nodes cause 'IOC extinction'.
The joint advisory 'Defending Against China-Nexus Covert Networks of Compromised Devices' (CISA alert code AA26-113A), co-issued by NCSC-UK, ASD/ACSC, the Canadian Centre for Cyber Security, BfV/BND/BSI, Japan NCO, AIVD/MIVD, NCSC-NZ, Spain CCN, NCSC-SE, CISA, DC3, FBI and NSA (15 partners from 9 countries alongside the NCSC-UK), describes a strategic shift in Chinese state-sponsored operations away from dedicated, actor-owned infrastructure toward dynamic, distributed networks of compromised devices. These covert networks are made up mainly of small office/home office (SOHO) routers, plus IoT and smart devices (web cameras, video recorders), firewalls and network-attached storage, many of them end-of-life or unsupported by the manufacturer. They are used at scale to hide the origin of operations and support activity across the kill chain, including reconnaissance, malware delivery, command and control and data exfiltration, to target critical sectors globally, steal sensitive data and maintain persistent access.
The advisory cites two earlier networks as examples. The KV Botnet, used by Volt Typhoon and built mostly from end-of-life Cisco and NetGear routers, was disrupted in a court-authorized FBI operation (December 2023, announced by DOJ on 31 January 2024) and supported pre-positioning against critical infrastructure. Raptor Train, a botnet of more than 200,000 devices (reported as over 260,000 by FBI) built with a custom Mirai variant called Nosedive, was attributed by FBI to Flax Typhoon and to the PRC company Integrity Technology Group, which managed it using China Unicom Beijing Province Network IP addresses; it was disrupted by FBI in September 2024. Public reporting describes Raptor Train as a three-tier architecture (Tier 1 compromised devices, Tier 2 C2 and exploitation servers, Tier 3 'Sparrow' management nodes).
A central defensive problem is what Mandiant termed 'IOC extinction': because these networks are constantly refreshed and share nodes across multiple threat groups, indicators disappear as quickly as they are discovered, so static IP/domain blocklists have a short useful life. The advisory therefore recommends that defenders track covert networks as evolving entities. No CVEs, malware hashes, IPs or domains are published in the advisory itself. Guidance by organization size: all organizations should map edge devices, baseline normal connections (especially VPN and remote-access traffic), question consumer broadband address ranges, require MFA for remote access and use dynamic threat feeds. Larger or higher-risk organizations should use IP allow lists rather than deny lists for VPN, geographic filtering based on OS/timezone profiles, zero trust, machine certificates, a smaller internet-facing footprint and ML anomaly detection. The most at-risk organizations should actively hunt for covert-network IPs, track networks via banners and certificates, run dynamic blocklists with alerting and analyze NetFlow upstream. Severity HIGH is an analyst assessment; the sources do not state a score.
MITRE ATT&CK techniques used in TL-2026-3861
Command and Control
T1090.003 Proxy: Multi-hop Proxy
Resource Development
T1583.003 Acquire Infrastructure: Virtual Private Server; T1584.005 Compromise Infrastructure: Botnet; T1584.008 Compromise Infrastructure: Network Devices
Reconnaissance
Affected products and versions in China-Nexus Covert Networks of Compromised Edge Devices
- Various — SOHO routers
Vulnerable versions: End-of-life or unsupported models, incl. Cisco and NetGear routers used in the KV Botnet - Various — IoT devices (IP cameras, DVR/NVR), firewalls and NAS devices
Vulnerable versions: Unpatched or unsupported devices
Remediation for China-Nexus Covert Networks of Compromised Edge Devices
Patches
- Replace end-of-life or unsupported routers and edge devices
- Apply vendor security updates to all edge devices, firewalls and NAS
Immediate actions
- Map all internet-facing edge devices (SOHO routers, firewalls, NAS, IoT) and baseline normal traffic, especially VPN and remote-access connections
- Question and review inbound connections from consumer broadband address ranges
- Require multi-factor authentication for all remote access
- Adopt dynamic threat feed filtering with known covert-network indicators
Workarounds
- Restrict management interfaces so they are not exposed to the internet
- Treat IP-based IOCs as short-lived and favor tracking covert networks as evolving entities rather than static indicators
Longer-term hardening
- Use IP allow lists rather than deny lists for VPN access
- Apply geographic filtering and OS/timezone profile checks to remote sessions
- Adopt zero trust policies and machine certificates for SSL/VPN
- Reduce internet-facing infrastructure
- Use machine learning / anomaly detection on edge traffic
- Actively hunt covert-network IPs, track networks via banners and certificates, and analyze upstream NetFlow
- Small organizations: use the free NCSC Cyber Action Toolkit; larger organizations: Cyber Essentials and the updated Cyber Assessment Framework
Timeline of China-Nexus Covert Networks of Compromised Edge Devices
- Black Lotus Labs assesses the origins of the Raptor Train botnet (Nosedive Mirai variant) go back to May 2020; the botnet is active since mid-2021.
- FBI-led, court-authorized operation (December 2023) removes KV Botnet malware from hijacked end-of-life Cisco and NetGear SOHO routers used by Volt Typhoon.
- US DOJ announces the KV Botnet disruption; routers were used to conceal the PRC origin of activity against US and foreign victims.
- Mandiant publishes 'IOC Extinction?' describing China-nexus ORB networks of VPS, IoT devices and end-of-life routers that defeat static indicators.
- FBI court-authorized operation disrupts the Raptor Train botnet (200,000+ devices; reported 260,000+) and attributes it to Flax Typhoon / Integrity Technology Group.
- US Treasury OFAC sanctions Integrity Technology Group for supporting Flax Typhoon intrusions against US victims.
- NCSC-UK, CISA, FBI, NSA, DC3 and partners publish advisory AA26-113A at CYBERUK 2026, warning of China-nexus covert networks used at scale against critical sectors.
- Partner agencies including NCSC-NZ and ASD ACSC republish the advisory and associated guidance.
Sources cited for China-Nexus Covert Networks of Compromised Edge Devices
- International cyber agencies share fresh advice to defend against China-linked covert networks (NCSC UK)
- CISA AA26-113A: Defending Against China-Nexus Covert Networks of Compromised Devices
- Defending against China-nexus covert networks of compromised devices (joint advisory PDF, IC3)
- Defending against China-nexus covert networks of compromised devices (NCSC-NZ)
- Defending against China-nexus covert networks of compromised devices (ASD ACSC)
- CISA, NCSC UK, and Global Partners Issue Advisory on Chinese Government-Linked Covert Cyber Networks (HSToday)
- IOC Extinction? China-Nexus Cyber Espionage Actors Use ORB Networks to Raise Cost on Defenders (Mandiant)
- FBI forced Flax Typhoon to abandon its botnet (Help Net Security)
- US feds shut down China-linked KV botnet (The Hacker News)
- U.S. Treasury sanctions Beijing-based Integrity Technology Group (The Hacker News)
Detection coverage for TL-2026-3861
As of 2026-10-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3861 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.