China-Linked Hackers Hide Behind Compromised Routers

Hackers linked to China are increasingly abusing compromised routers and edge devices to build covert networks, enabling stealthy cyber operations that are harder to detect and block.

Instead of relying on dedicated servers or purchased hosting, threat actors are now leveraging large-scale botnets made up of hacked small office/home office (SOHO) routers, IoT devices, and other edge systems.

This approach provides a flexible, low-cost, and highly deniable platform for cyber espionage campaigns.

Attackers use these networks to conduct reconnaissance, identifying potential targets and vulnerabilities. They also deliver malware through these nodes, making malicious traffic appear legitimate.

Once inside a network, the same infrastructure supports command-and-control (C2) communications and facilitates data exfiltration.

Security experts warn that these compromised device networks are not limited to a single stage of attack. Instead, they are used across the entire Cyber Kill Chain.

Because the traffic originates from legitimate but compromised devices, it becomes significantly harder for defenders to distinguish between benign and malicious activity.

Dynamic Infrastructure Evades Detection

One of the most concerning aspects of this threat is its dynamic nature. These covert networks are constantly evolving, with devices being added, removed, or reassigned across operations.

This creates what experts call “IOC extinction,” where indicators of compromise (IOCs) such as IP addresses quickly become obsolete.

Traditional defenses that rely on static blocklists struggle to keep up, as malicious infrastructure can change faster than it can be identified.

For example, an IP address flagged as malicious today may belong to a clean device tomorrow, while attackers rotate to new compromised nodes elsewhere.

The use of covert networks significantly increases the risk for organizations, particularly those in critical sectors. China-linked threat actors can leverage this infrastructure to launch espionage campaigns, steal sensitive data, and potentially disrupt essential services.

Organizations in regions such as the UK have been specifically highlighted as targets. However, the tactics are globally applicable, meaning enterprises worldwide could face similar threats.

Defenders relying solely on perimeter-based or static security measures may find their systems bypassed. In contrast, organizations that adopt adaptive, intelligence-driven defenses are better positioned to detect and mitigate these attacks.

Mitigations

To address this evolving threat, cybersecurity authorities, including the UK’s National Cyber Security Center (NCSC), have issued detailed guidance for organizations of all sizes.

Key recommendations include:

• Map and baseline normal traffic patterns across edge devices, especially VPNs and remote access systems.
• Deploy dynamic threat intelligence feeds capable of identifying known covert network indicators in real time.
• Enforce multi-factor authentication (MFA) for all remote access points.
• Implement zero trust architectures, including strict identity verification and access controls.
• Use IP allow lists and machine certificate verification where possible.

For larger or high-risk organizations, additional steps are advised:

• Actively hunt for suspicious traffic from IoT devices and SOHO.
• Apply geographic profiling to detect unusual access patterns.
• Leverage machine learning-based anomaly detection to identify subtle threats.

As threat actors continue to refine their tactics, organizations must shift away from static defenses toward more adaptive security models. Prompt implementation of traffic baselining, zero trust principles, and continuous monitoring is essential.

By proactively strengthening defenses, organizations can reduce exposure to covert network-based attacks and better protect critical assets from increasingly sophisticated China-linked cyber operations.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.