China-nexus actors exploit covert networks of compromised devices
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Chinese state-sponsored actors use large-scale botnets of hacked routers and IoT devices to mask attack origin and conduct cyber espionage and infrastructure pre-positioning.
The UK National Cyber Security Centre and international partners (NCSC-UK, ACSC, CCCS, BfV, BND, BSI, NCO, AIVD, MIVD, NCSC-NZ, CCN, NCSC-SE, CISA, DC3, FBI, NSA) have released a joint advisory on China-nexus cyber actors' shift toward using large-scale covert networks of compromised devices—primarily SOHO routers, IoT devices, firewalls, and NAS appliances—to facilitate cyber operations while obscuring attribution. These botnets route traffic through multiple compromised nodes via entry points, traversal nodes, and exit nodes, enabling reconnaissance, malware delivery, command and control, data exfiltration, and deniable reconnaissance. The Raptor Train botnet, managed by Chinese company Integrity Technology Group and attributed to Flax Typhoon, infected over 200,000 devices worldwide. Volt Typhoon used the KV Botnet, primarily comprising vulnerable end-of-life Cisco and NetGear routers. The dynamic and geographically distributed nature of these networks defeats static IP blocklists, creating an indicator-of-compromise extinction problem where individual IOCs lose value as networks are constantly updated and reused by multiple threat actors. Defenders face a significant challenge: traditional network defense paradigms based on blocking malicious IP addresses are substantially less effective against infrastructure where hundreds of thousands of endpoints may be part of the same covert network.
Mentioned in this report
Detection guidance
SSH Tunnel-Only Session with Dynamic or Reverse Port Forwarding
Detects ssh clients started with no remote command (-N) and with SOCKS (-D) or remote (-R) forwarding. This is how a host is turned into a traversal or proxy node in covert relay networks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SSH Tunnel-Only Session with Dynamic or Reverse Port Forwarding
id: 92be7f9c-b163-55f9-8dd9-9de2b0bab586
status: experimental
description: Detects ssh client execution with -N (no remote command) combined with
-D (SOCKS dynamic forwarding) or -R (reverse forwarding). Such use can turn a compromised
host or device into a relay or proxy node, as in covert networks of compromised
devices. Matches on the flag pattern, not on any specific host or address.
tags:
- attack.command-and-control
- attack.lateral-movement
- attack.t1090.001
- attack.t1021.004
logsource:
category: process_creation
product: linux
detection:
selection_img:
Image|endswith: /ssh
selection_forward:
CommandLine|contains:
- ' -D '
- ' -R '
selection_nocmd:
CommandLine|contains:
- ' -N'
- ' -fN'
condition: selection_img and selection_forward and selection_nocmd
falsepositives:
- Administrators or developers opening SOCKS or reverse tunnels for remote access
to internal services
- Automation that maintains persistent SSH tunnels, for example autossh wrappers
level: medium
author: Vorant
references:
- https://www.ncsc.gov.uk/news/defending-against-china-nexus-covert-networks-of-compromised-devices
Netsh Port Proxy Rule Added
Detects netsh creating an interface portproxy rule, which lets a Windows host relay traffic as an internal proxy or traversal node. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Netsh Port Proxy Rule Added
id: 3f28915e-92cd-541a-b6ec-d2b448515002
status: experimental
description: Detects netsh.exe adding an interface portproxy rule. Attackers use this
to forward traffic through a compromised host, acting as an internal proxy hop that
hides the true origin of operator traffic.
tags:
- attack.command-and-control
- attack.t1090.001
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \netsh.exe
CommandLine|contains|all:
- interface
- portproxy
- add
condition: selection
falsepositives:
- Administrators configuring port forwarding for WSL, Hyper-V or legacy application
migration
- Lab or developer machines exposing local services
level: medium
author: Vorant
references:
- https://www.ncsc.gov.uk/news/defending-against-china-nexus-covert-networks-of-compromised-devices
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ncsc.gov.uk/news/defending-against-china-nexus-covert-networks-of-compromised-devices
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs