Defending against China-nexus covert networks of compromised devices

Over the past few years there has been a major shift in the tactics, techniques and procedures (TTPs) used by China-nexus cyber actors,  towards the use of externally provisioned, large-scale networks of compromised devices, or “covert networks”.

The use of covert networks of compromised devices to facilitate malicious cyber activity is not new, but China-nexus cyber actors are now using them strategically, and at scale.

Covert networks are mainly made up of compromised Small Office Home Office (SOHO) routers, as well as Internet of Things (IoT), smart devices, firewalls and Network Attached Storage (NAS) devices.

This advisory describes the typical makeup of a covert network and what they are being used for. It also includes protective advice for organisations being targeted by cyber activity using a covert network as an access vector.