# China-Nexus Covert Networks of Compromised Edge Devices (SOHO Routers, IoT, NAS, Firewalls) Targeting Critical Sectors - Joint Advisory AA26-113A

> On 23 April 2026 CISA, FBI, DC3, NSA, NCSC-UK and partner agencies from Australia, Canada, Germany, Japan, the Netherlands, New Zealand, Spain and Sweden published joint advisory AA26-113A on China-nexus actors operating large-scale covert networks built from compromised SOHO routers, IoT devices, firewalls and NAS devices. The networks obscure attribution and support reconnaissance, malware delivery, command-and-control and data exfiltration against critical sectors, and rapidly rotating nodes cause 'IOC extinction'.

- **Published:** 2026-10-19T07:03:07Z
- **Last reviewed:** 2026-10-19T07:03:07Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3861
- **ID:** TL-2026-3861
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The joint advisory 'Defending Against China-Nexus Covert Networks of Compromised Devices' (CISA alert code AA26-113A), co-issued by NCSC-UK, ASD/ACSC, the Canadian Centre for Cyber Security, BfV/BND/BSI, Japan NCO, AIVD/MIVD, NCSC-NZ, Spain CCN, NCSC-SE, CISA, DC3, FBI and NSA (15 partners from 9 countries alongside the NCSC-UK), describes a strategic shift in Chinese state-sponsored operations away from dedicated, actor-owned infrastructure toward dynamic, distributed networks of compromised devices. These covert networks are made up mainly of small office/home office (SOHO) routers, plus IoT and smart devices (web cameras, video recorders), firewalls and network-attached storage, many of them end-of-life or unsupported by the manufacturer. They are used at scale to hide the origin of operations and support activity across the kill chain, including reconnaissance, malware delivery, command and control and data exfiltration, to target critical sectors globally, steal sensitive data and maintain persistent access.

The advisory cites two earlier networks as examples. The KV Botnet, used by Volt Typhoon and built mostly from end-of-life Cisco and NetGear routers, was disrupted in a court-authorized FBI operation (December 2023, announced by DOJ on 31 January 2024) and supported pre-positioning against critical infrastructure. Raptor Train, a botnet of more than 200,000 devices (reported as over 260,000 by FBI) built with a custom Mirai variant called Nosedive, was attributed by FBI to Flax Typhoon and to the PRC company Integrity Technology Group, which managed it using China Unicom Beijing Province Network IP addresses; it was disrupted by FBI in September 2024. Public reporting describes Raptor Train as a three-tier architecture (Tier 1 compromised devices, Tier 2 C2 and exploitation servers, Tier 3 'Sparrow' management nodes).

A central defensive problem is what Mandiant termed 'IOC extinction': because these networks are constantly refreshed and share nodes across multiple threat groups, indicators disappear as quickly as they are discovered, so static IP/domain blocklists have a short useful life. The advisory therefore recommends that defenders track covert networks as evolving entities. No CVEs, malware hashes, IPs or domains are published in the advisory itself. Guidance by organization size: all organizations should map edge devices, baseline normal connections (especially VPN and remote-access traffic), question consumer broadband address ranges, require MFA for remote access and use dynamic threat feeds. Larger or higher-risk organizations should use IP allow lists rather than deny lists for VPN, geographic filtering based on OS/timezone profiles, zero trust, machine certificates, a smaller internet-facing footprint and ML anomaly detection. The most at-risk organizations should actively hunt for covert-network IPs, track networks via banners and certificates, run dynamic blocklists with alerting and analyze NetFlow upstream. Severity HIGH is an analyst assessment; the sources do not state a score.

## MITRE ATT&CK

- T1584.005 Compromise Infrastructure: Botnet
- T1584.008 Compromise Infrastructure: Network Devices
- T1583.003 Acquire Infrastructure: Virtual Private Server
- T1090.003 Proxy: Multi-hop Proxy
- T1595 Active Scanning

## Sources

- [International cyber agencies share fresh advice to defend against China-linked covert networks (NCSC UK)](https://www.ncsc.gov.uk/news/international-cyber-agencies-fresh-advice-defend-against-china-linked-covert-networks)
- [CISA AA26-113A: Defending Against China-Nexus Covert Networks of Compromised Devices](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-113a)
- [Defending against China-nexus covert networks of compromised devices (joint advisory PDF, IC3)](https://www.ic3.gov/CSA/2026/260423.pdf)
- [Defending against China-nexus covert networks of compromised devices (NCSC-NZ)](https://www.ncsc.govt.nz/alerts/defending-against-china-nexus-covert-networks-of-compromised-devices/)
- [Defending against China-nexus covert networks of compromised devices (ASD ACSC)](https://cyber.gov.au/about-us/view-all-content/alerts-and-advisories/defending-against-china-nexus-covert-networks-of-compromised-devices)
- [CISA, NCSC UK, and Global Partners Issue Advisory on Chinese Government-Linked Covert Cyber Networks (HSToday)](https://www.hstoday.us/subject-matter-areas/cybersecurity/cisa-ncsc-uk-and-global-partners-issue-advisory-on-chinese-government-linked-covert-cyber-networks/)
- [IOC Extinction? China-Nexus Cyber Espionage Actors Use ORB Networks to Raise Cost on Defenders (Mandiant)](https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-orb-networks)
- [FBI forced Flax Typhoon to abandon its botnet (Help Net Security)](https://www.helpnetsecurity.com/2024/09/19/flax-typhoon-botnet-disrupted/)
- [US feds shut down China-linked KV botnet (The Hacker News)](https://thehackernews.com/2024/02/us-feds-shut-down-china-linked-kv.html)
- [U.S. Treasury sanctions Beijing-based Integrity Technology Group (The Hacker News)](https://thehackernews.com/2025/01/us-treasury-sanctions-beijing.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3861