China-Linked Cyber Actors Turn to Massive Covert Botnets to Evade Detection

A coordinated advisory from the NCSC-UK and partners warns that China‑Nexus actors increasingly rely on large, dynamic covert networks of compromised SOHO routers, IoT devices, and other internet‑connected hardware to mask operations, route traffic, and pre-position capabilities; the report gives examples (Raptor Train, KV Botnet, Volt and Flax Typhoon), explains attribution and detection challenges (IOC extinction, node churn), and recommends inventorying edge devices, baselining activity, applying zero‑trust and allow‑listing, and using threat intelligence and ML for detection.