# China-nexus actors exploit covert networks of compromised devices

Published: 2026-04-23 · Severity: routine · Sectors: energy, government-national, defense, infrastructure, healthcare, transportation, technology
Canonical: https://vorant.io/reports/76b5668f-4d8d-5283-8386-1a44afc66b07/china-nexus-actors-exploit-covert-networks-of-compromised-devices

> Chinese state-sponsored actors use large-scale botnets of hacked routers and IoT devices to mask attack origin and conduct cyber espionage and infrastructure pre-positioning.

The UK National Cyber Security Centre and international partners (NCSC-UK, ACSC, CCCS, BfV, BND, BSI, NCO, AIVD, MIVD, NCSC-NZ, CCN, NCSC-SE, CISA, DC3, FBI, NSA) have released a joint advisory on China-nexus cyber actors' shift toward using large-scale covert networks of compromised devices—primarily SOHO routers, IoT devices, firewalls, and NAS appliances—to facilitate cyber operations while obscuring attribution. These botnets route traffic through multiple compromised nodes via entry points, traversal nodes, and exit nodes, enabling reconnaissance, malware delivery, command and control, data exfiltration, and deniable reconnaissance. The Raptor Train botnet, managed by Chinese company Integrity Technology Group and attributed to Flax Typhoon, infected over 200,000 devices worldwide. Volt Typhoon used the KV Botnet, primarily comprising vulnerable end-of-life Cisco and NetGear routers. The dynamic and geographically distributed nature of these networks defeats static IP blocklists, creating an indicator-of-compromise extinction problem where individual IOCs lose value as networks are constantly updated and reused by multiple threat actors. Defenders face a significant challenge: traditional network defense paradigms based on blocking malicious IP addresses are substantially less effective against infrastructure where hundreds of thousands of endpoints may be part of the same covert network.

## Mentioned in this report

- Threat actors: Flax Typhoon, Volt Typhoon
- Malware: KV-botnet, Raptor Train

## Detection guidance (public sample)

### SSH Tunnel-Only Session with Dynamic or Reverse Port Forwarding

ATT&CK: T1090.001

Detects ssh clients started with no remote command (-N) and with SOCKS (-D) or remote (-R) forwarding. This is how a host is turned into a traversal or proxy node in covert relay networks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SSH Tunnel-Only Session with Dynamic or Reverse Port Forwarding
id: 92be7f9c-b163-55f9-8dd9-9de2b0bab586
status: experimental
description: Detects ssh client execution with -N (no remote command) combined with
  -D (SOCKS dynamic forwarding) or -R (reverse forwarding). Such use can turn a compromised
  host or device into a relay or proxy node, as in covert networks of compromised
  devices. Matches on the flag pattern, not on any specific host or address.
tags:
- attack.command-and-control
- attack.lateral-movement
- attack.t1090.001
- attack.t1021.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith: /ssh
  selection_forward:
    CommandLine|contains:
    - ' -D '
    - ' -R '
  selection_nocmd:
    CommandLine|contains:
    - ' -N'
    - ' -fN'
  condition: selection_img and selection_forward and selection_nocmd
falsepositives:
- Administrators or developers opening SOCKS or reverse tunnels for remote access
  to internal services
- Automation that maintains persistent SSH tunnels, for example autossh wrappers
level: medium
author: Vorant
references:
- https://www.ncsc.gov.uk/news/defending-against-china-nexus-covert-networks-of-compromised-devices
```

### Netsh Port Proxy Rule Added

ATT&CK: T1090.001

Detects netsh creating an interface portproxy rule, which lets a Windows host relay traffic as an internal proxy or traversal node. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Netsh Port Proxy Rule Added
id: 3f28915e-92cd-541a-b6ec-d2b448515002
status: experimental
description: Detects netsh.exe adding an interface portproxy rule. Attackers use this
  to forward traffic through a compromised host, acting as an internal proxy hop that
  hides the true origin of operator traffic.
tags:
- attack.command-and-control
- attack.t1090.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \netsh.exe
    CommandLine|contains|all:
    - interface
    - portproxy
    - add
  condition: selection
falsepositives:
- Administrators configuring port forwarding for WSL, Hyper-V or legacy application
  migration
- Lab or developer machines exposing local services
level: medium
author: Vorant
references:
- https://www.ncsc.gov.uk/news/defending-against-china-nexus-covert-networks-of-compromised-devices
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ncsc.gov.uk/news/defending-against-china-nexus-covert-networks-of-compromised-devices

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/76b5668f-4d8d-5283-8386-1a44afc66b07/china-nexus-actors-exploit-covert-networks-of-compromised-devices.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup