China-Backed Hackers Are Industrializing Botnets

This joint advisory warns that China-nexus actors and related entities are systematically building and maintaining large, dynamic covert botnets composed mostly of SOHO routers and IoT/edge devices, which are being used at scale for reconnaissance, malware delivery/C2, and data exfiltration. The advisory highlights an operational model of specialization (compromise, curation, provisioning, operational use) that increases scale and plausible deniability, makes attribution and static-mitigation approaches ineffective, and recommends defenders profile and harden network edge devices, apply zero-trust controls, and conduct targeted threat hunting.