Global security authorities have warned of a malign China-nexus threat infecting large-scale networks of compromised devices.

The Cybersecurity and Infrastructure Security Agency (CISA) joined global counterparts, the National Security Agency, and FBI to warn of covert networks made up of compromised small office/home office (SOHO) routers, IoT devices, and smart appliances. The advisory said this represented a move “in the tactics, techniques and procedures used by China-nexus cyber actors” against individually procured infrastructure, flagging efforts by reported Chinese state-sponsored actors such as Volt Typhoon, Flax Typhoon, and the Raptor Train botnet, which in 2024 infected more than 200,000 devices worldwide.

The advisory noted the Volt Typhoon-linked KV Botnet used in the attack mainly involved end-of-life Cisco and NetGear routers. Cisco, in particular, has been beset by compromises of its older equipment to the extent it recently faced questions from the U.S. government over a firewall-based exploit that may have allowed for a nation-state-backed breach. The volume of issues prompted Cisco to unveil its Resilient Infrastructure venture, which aimed to resolve users' problems with legacy ware.

Netgear, meanwhile, is embroiled in a dispute with rival TP-Link Systems over claims of Chinese espionage, which it staunchly denies.

How cover networks work and what to do next

CISA’s joint warning explained the basic setup of a covert network, with an attacker connecting to the network via an on-ramp or entry node, and then forwarding traffic through multiple compromised devices, used as traversal nodes. It then departs from the network via an exit node, usually based in the same geographic region as the target.

Britain’s National Cyber Security Centre recommended organizations map all network edge devices and baseline normal connection patterns to identify anomalies alongside examples of basic security hygiene such as multifactor authentication for remote connections.

The body also recommended higher-risk organizations move toward a zero-trust model, set up IP and geographic allow lists, and profile incoming connections by system configuration. For those at the highest risk, it was deemed crucial to track China-nexus covert networks as specific advanced persistent threats (APT) using NetFlow feeds and active hunting to identify compromised SOHO or IoT devices.

Hygiene and AI

Samantha Kight, head of industry security at telecom industry group GSMA, recently told SDxCentral it “always surprised her” how many enterprises don’t follow basic cybersecurity hygiene, opening them up to nation-state attacks.

“That’s contributed to the successful pre-positioning of attacks, where you may see a nation-state adversary sitting on a network for a while, gathering intelligence before they actually carry out the attack. We're seeing a lot more of that exploiting weak cyber hygiene,” Kight said.

The biggest attack in the telecom space to date is arguably the 2024 Salt Typhoon exploit, which infamously compromised core and edge network devices. Melissa Bischoping, head of security research at Tanium, said the supposedly China-backed breach “made the hair on the back of her neck stand up a little bit” through its sheer scale and what it portends in the AI and quantum era.

“When you layer the Salt Typhoon problem with the advances in AI and what they could do to process that vast amount of data, and then you layer on the risk of a potential post-quantum cryptography future actualizing harvest-now-decrypt later issues, then the threat becomes very, very real,” Bischoping said. “From an intelligence gathering perspective, even from a propaganda lens, attackers understand more about human behavior, about the cultural issues at play. … It’s not just the one breach, it's not just the one tooling advance, it's all of those things stacked on top of each other coming to a head. And I think we need to be taking that threat very seriously."

Organizations such as BT, Amdocs, and VodafoneThree have begun talking up the AI-security threat, while the Federal Communications Commission (FCC) recently initiated plans to ban imports of all foreign-produced routers over “unacceptable risks to national security.” Senator Maria Cantwell (D-Washington) recently urged a subpoena for AT&T and Verizon CEOs over their response to Salt Typhoon.

CISA’s joint advisory follows recent reports of China-linked "sleeper cells" found embedded in telecom networks as well as security firm F5 revealing that a China-linked threat actor had breached its networks for a long-term pre-positioning of the sort flagged by the GSMA. Elsewhere in the world, all of Singapore’s main operators were attacked last year by alleged China-nexus group UNC3886, which was responsible for an earlier breach of Juniper Networks' Junos OS routers.

The fallout from Salt Typhoon has continued, with the reportedly China-backed group believed to have hacked congressional staff email accounts in the U.S. Cisco also fell under the spotlight again when SentinelLabs claimed two of its former trainees may have partly orchestrated the attack.

In response to the report, a Cisco spokesperson reminded that its Networking Academy is a program “open to everyone,” with more than 28 million students having walked through its doors.

"Cisco remains committed to helping people around the world gain the foundational digital skills needed to access careers in technology and the opportunities they provide," the spokesperson added.