Chinese attackers are pwning your infrastructure to use in attacks, 10 countries warn

A 10-country joint advisory warns that China-linked threat actors are strategically using large covert networks of compromised routers and IoT devices (botnets) to conduct intrusions, steal data, and stage disruptive operations. The report highlights examples such as Raptor Train (over 200,000 infected devices in 2024) and Volt Typhoon's KV Botnet, notes overlap between state-linked and criminal misuse of proxy networks, and urges defenders to map edge-device traffic, apply MFA and zero-trust controls, and hunt for suspicious SOHO/IoT activity.