China-nexus cyber actors' are turning routers and IoT infrastructure into covert botnets 'at scale' – NCSC, Five Eyes, and others warn of campaign involving Typhoon-designated groups

Abstract image of robots working in an office environment including creating blueprint of robot arm, making a phone call, and typing on a keyboard.

• A joint advisory from 10 nations warns that Chinese state‑sponsored groups are using large botnets of compromised IoT and SOHO devices.
• These covert networks allow attackers to hide their location, launch DDoS attacks, spread malware, and steal sensitive data at scale.
• Agencies urge organizations to patch devices, enforce strong credentials, and monitor for compromise indicators to reduce exposure.

Most Chinese state-sponsored threat actors are using botnets of compromised IoT and SOHO devices as their cybercriminal infrastructure, a new 10-country joint security advisory is saying.