China-linked threat actors use consumer device botnets to evade detection, warn UK and partners

The UK NCSC and international partners warn that China-linked actors are increasingly using vast botnets of compromised SOHO/IoT devices as dynamic proxy networks to hide and route attacks across the full cyber kill chain; the advisory outlines mitigation measures (traffic baselining, MFA, zero trust, dynamic threat feeds, active hunting) and references the large Raptor Train botnet attributed to Flax Typhoon/Ethereal Panda.