Microsoft: Chinese hackers use Quad7 botnet to steal credentials

**Executive Summary:** Microsoft and multiple security researchers describe Quad7 (aka CovertNetwork-1658 / xlogin), a botnet of compromised SOHO routers (TP-Link, ASUS, Ruckus, Axentra, Zyxel) that deploys Telnet-based backdoors and SOCKS5 proxies; the infrastructure is being used in low-noise password-spray campaigns to steal credentials that Chinese threat actors (notably Storm-0940) then use to breach networks, move laterally, install RATs/proxies for persistence, and exfiltrate data, with at least one observed chain involving an OpenWRT zero-day.