UK and allied agencies warn that China-linked hackers are using compromised everyday devices to route cyberattacks
The Facts
- The UK National Cyber Security Centre and partner agencies in multiple allied countries issued a joint advisory about China-linked cyber actors' use of compromised-device networks.
- The advisory says China-linked hackers are using large networks of compromised routers, IoT products and other edge devices to route or proxy their cyber operations.
- The agencies describe a shift away from individually procured or dedicated attacker infrastructure toward externally provisioned, large-scale networks of compromised devices.
- According to the warning, these compromised-device networks are used to support activities including reconnaissance, malware delivery or communications, surveillance, and data theft or exfiltration.
- The advisory says the technique helps obscure the origin of attacks and makes malicious activity harder for defenders to detect, attribute, and disrupt.
- Multiple reports say the warning applies broadly to organizations that may be targeted by China-linked cyber actors, including businesses and critical sectors in Western countries.
- The agencies say vulnerable or poorly maintained devices, such as older equipment or devices missing software updates, can be incorporated into these networks.
- The advisory includes defensive guidance urging organizations to strengthen visibility into edge-device traffic and improve basic security measures such as patching and monitoring.
Context
What are these compromised-device networks?
They are networks of hacked routers, small-office/home-office equipment, IoT products and other internet-connected devices that attackers use as proxy infrastructure to route malicious traffic and hide where operations are coming from Guardian,TheRegister.com,cybersecuritydive.c….
Why are security agencies warning businesses now?
The agencies say China-linked actors have increasingly adopted this method at scale in recent years, and that it can make espionage and other intrusions harder to spot, investigate and stop because the traffic appears to come from ordinary compromised devices rather than dedicated attacker systems Computer Weekly,CyberScoop,Narooma News.
What are organizations being told to do?
The advisory urges organizations to improve monitoring of edge devices and related traffic, establish baselines for normal activity, and keep vulnerable devices updated and maintained so they are less likely to be hijacked or used as part of these networks Guardian,IT Security News - …,cybersecuritydive.c….
How left and right read it
What stands out is how much collective security now depends on the weakest, least-maintained devices connected to everyday networks. When agencies say compromised routers, IoT products, and other edge devices can be used to support surveillance, malware delivery, and data theft while making attacks harder to detect, it underscores the need for broad basic protections like patching, monitoring, and better visibility.
The key issue is strategic resilience against a foreign-linked cyber threat that is adapting its methods to evade detection and disruption. A joint advisory from the UK National Cyber Security Centre and allied agencies describes a move from dedicated attacker infrastructure to large compromised-device networks, which makes disciplined maintenance, patching, and visibility into edge-device traffic a matter of organizational self-protection.
The receipts — all 15 sources
Independent coverage (15)
Facts first. Then every angle.
The day’s biggest stories in one short brief — the facts everyone agrees on, then the competing values behind the headlines. Free in your inbox.