UK warns of Chinese hackers using proxy networks to evade detection

The UK NCSC and international partners warn that China-linked threat actors increasingly route malicious activity through vast botnets of compromised SOHO routers and IoT devices to mask origin and evade detection. The advisory highlights large-scale operations such as Raptor Train (over 260,000 infected devices) tied to Flax Typhoon and KV-Botnet used by Volt Typhoon, notes FBI disruption activities, outlines targeted sectors (military, government, telecoms, education, DIB, IT), and urges defenders to adopt multifactor authentication, dynamic threat feeds, allowlists/zero-trust controls, and device hygiene.