China-Linked Groups Built Covert Botnets From Compromised Routers and IoT Devices

A joint advisory from the UK NCSC, the United States, and other international partners warned that China-nexus threat actors are increasingly using large covert networks of compromised SOHO routers, IoT devices, firewalls, and NAS systems to route malicious traffic, hide attribution, and support espionage and disruptive operations. The warning said these botnet-style proxy networks are used across the full cyber kill chain, from reconnaissance and malware delivery to command-and-control and data theft, and identified activity tied to Volt Typhoon, Flax Typhoon, and the Raptor Train botnet. Officials said Volt Typhoon’s KV Botnet relied heavily on end-of-life Cisco and Netgear routers, while Raptor Train infected more than 200,000 devices worldwide and was reportedly controlled by Integrity Technology Group.

Governments said the scale and churn of these compromised-device networks make traditional static IP blocklists increasingly ineffective, creating what some reporting described as rapid indicator loss or “IOC extinction.” Agencies urged organizations to map internet-facing and edge assets, baseline normal traffic from routers and IoT devices, enforce MFA, apply dynamic threat intelligence, use allow-listing and zero trust controls, and actively hunt for suspicious proxy-node behavior on residential, branch, and enterprise-connected infrastructure. The disclosures also linked the threat to broader Chinese pre-positioning activity against critical infrastructure and telecom environments, underscoring how weakly secured edge devices continue to provide durable operational cover for state-backed intrusions.