Loading story…
Forescout reported that Chinese-manufactured connected devices continued to expand across U.S. enterprise networks despite federal restrictions and long-running national security concerns. Its analysis found nearly 300,000 such devices from 473 Chinese manufacturers in U.S. networks in February 2024, accounting for 3.8% of observed devices and marking a 41% year-over-year increase. The growth was especially notable in critical sectors including healthcare, manufacturing, government, utilities, and financial services.
The report said banned products, including Hikvision and Dahua cameras, remained present even in government environments, while many Chinese-made devices were directly exposed to the internet. Forescout identified hundreds of exposed Hikvision and Dahua systems across dozens of small U.S. utilities and warned that such devices could provide opportunities for espionage, disruption, and initial access. The findings also pointed to prior exploitation of Hikvision vulnerabilities and the use of IoT devices by Chinese APT actors in operations targeting critical infrastructure.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
In its February 2024 U.S. dataset, Forescout observed close to 300,000 devices from 473 Chinese manufacturers, representing 3.8% of 7.5 million observed devices. The report said this reflected 41% year-over-year growth and continued presence despite official bans.
Using its February 2023 U.S. dataset, Forescout estimated roughly 185,000 Chinese-manufactured devices in U.S. networks out of 6.7 million observed devices.
The FCC banned the sale in the United States of equipment made by Huawei, ZTE, Hikvision, Dahua, and Hytera over national security concerns.
Forescout previously identified more than 2,000 Chinese-manufactured cameras in U.S. government networks, establishing an earlier baseline for the presence of such devices in government environments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A joint advisory from the UK **NCSC**, the United States, and other international partners warned that China-nexus threat actors are increasingly using large covert networks of compromised **SOHO routers, IoT devices, firewalls, and NAS systems** to route malicious traffic, hide attribution, and support espionage and disruptive operations. The warning said these botnet-style proxy networks are used across the full cyber kill chain, from reconnaissance and malware delivery to command-and-control and data theft, and identified activity tied to **Volt Typhoon**, **Flax Typhoon**, and the **Raptor Train** botnet. Officials said Volt Typhoon’s **KV Botnet** relied heavily on end-of-life Cisco and Netgear routers, while Raptor Train infected more than **200,000** devices worldwide and was reportedly controlled by **Integrity Technology Group**. Governments said the scale and churn of these compromised-device networks make traditional static IP blocklists increasingly ineffective, creating what some reporting described as rapid indicator loss or “IOC extinction.” Agencies urged organizations to map internet-facing and edge assets, baseline normal traffic from routers and IoT devices, enforce **MFA**, apply dynamic threat intelligence, use allow-listing and **zero trust** controls, and actively hunt for suspicious proxy-node behavior on residential, branch, and enterprise-connected infrastructure. The disclosures also linked the threat to broader Chinese pre-positioning activity against critical infrastructure and telecom environments, underscoring how weakly secured edge devices continue to provide durable operational cover for state-backed intrusions.
Jun 29, 2026
The U.S. Federal Communications Commission expanded its restrictions on Chinese telecommunications and surveillance equipment, banning the import and sale of certain products from companies on the FCC Covered List, including **Huawei**, **ZTE**, **Hytera**, **Hikvision**, and **Dahua**. The move closes a loophole that had allowed some previously authorized or older models to continue being sold, with regulators citing national security and cybersecurity concerns tied to unpatched vulnerabilities, outdated firmware, insecure protocols, and potential unauthorized data access or surveillance capabilities. The ban applies to equipment such as routers, base stations, video monitoring systems, and other network infrastructure components used across communications networks, government facilities, critical infrastructure, and public safety environments. Already deployed devices are not subject to immediate removal, and some existing inventory may continue to be used, while the FCC is also considering further limits on U.S. telecom interconnection with Chinese carriers that could restrict those firms' ability to manage U.S. data centers.
Jul 2, 2026
SentinelLABS disrupted multiple China-nexus cyberespionage campaigns between June 2024 and March 2025 targeting SentinelOne, a South Asian government entity, a European media organization, and more than 70 other victims. The ShadowPad and PurpleHaze clusters used chained zero-days in edge appliances, including `CVE-2024-8963` and `CVE-2024-8190`, alongside ShadowPad malware protected by ScatterBrain/ScatterBee obfuscation, the Go-based GOREshell reverse-SSH backdoor, Nimbo-C2, operational relay box networks, and log removal. SentinelOne reported that it was not compromised. A joint Tenable-SentinelOne review shows that this activity reflects a broader cross-actor pattern: 93 CVE-to-actor attribution pairs across 82 vulnerabilities converged on all seven identified edge-device vendors, despite only 21% overlap in the CVEs tracked independently. Twelve flaws have confirmed exploitation by multiple China-, Russia-, DPRK-, or Iran-linked groups and ransomware operators. F5, Citrix, and Ivanti EPMM and Connect Secure deployments face recurring exposure and exploitation; organizations should prioritize edge-device patching, disable unnecessary features, continuously monitor remote-access systems, and use segmentation and other defense-in-depth controls to limit lateral movement after a breach.
Aug 26, 2026