Compromised Routers Mask China-Linked Cyber Campaigns

This advisory describes China-linked state-sponsored actors hijacking thousands of home and small-business routers to form dynamic covert networks (botnets) that support scanning, reconnaissance, and full-chain cyber operations. The report warns these rapidly reshuffled infrastructures cause IOC extinction and defeat static IP blocklists, increasing risk to UK and global organizations, and summarizes mitigation guidance from the NCSC and partners (mapping edge traffic, dynamic threat feeds, MFA, zero-trust and strict access controls).