A dozen allied agencies say China is building covert hacker networks out of everyday routers | CyberScoop<\/title> <meta name=\"description\" content=\"Global agencies issue a major warning on China-nexus covert networks, as hackers shift tactics to exploit SOHO routers and IoT devices to target infrastructure.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/china-nexus-covert-networks-advisory\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"A dozen allied agencies say China is building covert hacker networks out of everyday routers\"> <meta property=\"og:description\" content=\"Global agencies issue a major warning on China-nexus covert networks, as hackers shift tactics to exploit SOHO routers and IoT devices to target infrastructure.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/china-nexus-covert-networks-advisory\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cyberscoop\/\"> <meta property=\"article:published_time\" content=\"2026-04-23T16:13:51+00:00\"> <meta property=\"article:modified_time\" content=\"2026-04-23T16:13:54+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-5.jpg\"> <meta property=\"og:image:width\" content=\"2121\"> <meta property=\"og:image:height\" content=\"1414\"> <meta property=\"og:image:type\" content=\"image\/jpeg\"> <meta name=\"author\" content=\"Greg Otto\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:creator\" content=\"@gregotto\"> <meta name=\"twitter:site\" content=\"@CyberScoopNews\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1774626878g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1774625888g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1775068334g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=13897d660a0ac2c9c7d1\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" title=\"JSON\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/88726\"><meta name=\"generator\" content=\"WordPress 6.8.5\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=88726\">\n<link rel=\"alternate\" title=\"oEmbed (JSON)\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fchina-nexus-covert-networks-advisory%2F\">\n<link rel=\"alternate\" title=\"oEmbed (XML)\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fchina-nexus-covert-networks-advisory%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"wp-singular post-template-default single single-post postid-88726 single-format-standard wp-theme-scoopnewsgroup wp-child-theme-cyberscoop\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/china-nexus-covert-networks-advisory\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--newsletter js-stickybar\" readability=\"0.82\"> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"25.267441860465\">\n<div class=\"single-article__header-content\" readability=\"34.265060240964\">\n<ul class=\"single-article__eyebrow\">\n<li class=\"single-article__category\"> <a class=\"single-article__category-link\" href=\"https:\/\/cyberscoop.com\/china-nexus-covert-networks-advisory\/\"> <span>Government<\/span> <\/a> <\/li>\n<\/ul>\n<p> The joint warning describes a major tactical shift by Chinese-linked hackers and lays out what organizations should do about it. <\/p>\n<p>  <br \/>\n<audio id=\"audio-player\" src=\"https:\/\/wp-tts-cdn.api.scpnewsgrp.com\/cyberscoop\/88726\/english.openai.mp3\"><\/audio> <\/p>\n<div readability=\"11\">\n<div>\n<p>Listen to this article<\/p>\n<p>  <\/p>\n<p>0:00<\/p>\n<\/p><\/div>\n<p>  <\/p>\n<p> <span id=\"tts-tooltip\">Learn more.<\/span> <span> This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment. <\/span> <\/p>\n<\/div>\n<p>  <\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"426\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers.jpg?resize=640%2C426&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-5.jpg 2121w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-5.jpg?resize=300,200 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-5.jpg?resize=768,512 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-5.jpg?resize=1024,683 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-5.jpg?resize=1536,1024 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-5.jpg?resize=2048,1365 2048w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-5.jpg?resize=600,400 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-5.jpg?resize=252,168 252w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-5.jpg?resize=506,337 506w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-5.jpg?resize=1013,675 1013w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-5.jpg?resize=1265,843 1265w\" sizes=\"(max-width: 1013px) 100vw, 1013px\"><figcaption> (Getty images) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"38.92789034565\"><body readability=\"81.415814587594\"><\/p>\n<p>U.S. and international government agencies warned Thursday about a \u201cwidespread shift\u201d in Chinese hacker methods toward the use of large-scale covert networks that compromise common devices to carry out a variety of attacks.<\/p>\n<p><a href=\"https:\/\/www.cisa.gov\/news-events\/cybersecurity-advisories\/aa26-113a\">The advisory<\/a> details how those networks work, and defensive steps organizations should take.<\/p>\n<p>\u201cOver the past few years there has been a major shift in the tactics, techniques and procedures (TTPs) used by China-nexus cyber actors, moving away from the use of individually procured infrastructure, and towards the use of externally provisioned, large-scale networks of compromised devices,\u201d the warning reads.<\/p>\n<p>The U.K. National Cyber Security Centre, Cybersecurity and Infrastructure Security Agency, National Security Agency, FBI and agencies from Australia, Canada, Germany, Netherlands, New Zealand, Japan, Spain and Sweden joined forces on the advisory.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>It says that \u201cmultiple covert networks have been created and are being constantly updated, and that a single covert network could be being used by multiple actors. These networks are mainly made up of compromised Small Office Home Office (SOHO) routers, as well as Internet of Things (IoT) and smart devices.\u201d<\/p>\n<p>It continues: \u201cCovert networks are used to connect across the internet in a low-cost, low-risk, deniable way, disguising the origin and attribution of malicious activity.\u201d<\/p>\n<p>Chinese information security companies create and support the networks, evidence suggests, according to the agencies. Hackers use the networks for reconnaissance, malware delivery and stealing information, they said.<\/p>\n<p>Examples of the use of covert networks include activities from groups known as <a href=\"https:\/\/cyberscoop.com\/tag\/flax-typhoon\/\">Volt Typhoon<\/a> to pre-position on U.S. critical infrastructure, and <a href=\"https:\/\/cyberscoop.com\/tag\/flax-typhoon\/\">Flax Typhoon<\/a> to conduct cyber espionage.<\/p>\n<p>An example of a covert network is the botnet <a href=\"https:\/\/www.justice.gov\/archives\/opa\/pr\/court-authorized-operation-disrupts-worldwide-botnet-used-peoples-republic-china-state\">Raptor Train<\/a>, which infected 200,000 devices worldwide. The networks are large, constantly evolving and with new ones being developed constantly.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>At <a href=\"https:\/\/www.ncsc.gov.uk\/speech\/ncsc-ceo-keynote-speech-cyberuk-2026\">a speech<\/a> this week, NCSC CEO Richard Horne said \u201cwe\u202fknow\u202fthat\u202fChina\u2019s\u202fintelligence and military agencies now display an\u202feye-watering\u202flevel of\u202fsophistication\u202fin their cyber\u202foperations.\u201d<\/p>\n<p>Defenses against covert networks aren\u2019t \u201cstraightforward,\u201d according to the advisory, but include an assortment of common good cybersecurity practices. The largest and most at-risk organizations should engage in active hunting, tracking and mapping covert networks, using threat reporting to create blocklists and more.<\/p>\n<p>\u201cWorking closely with U.S. and international partners, CISA continues to identify and warn organizations of Chinese state-sponsored cyber actors threatening critical infrastructure,\u201d CISA Acting Director Nick Andersen said Thursday. \u201cThis advisory informs organizations of how these actors are strategically using numerous, evolving covert networks at scale for malicious cyber activity.\u201d<\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\">\n<div class=\"author-card\" readability=\"7.7216117216117\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-1.jpg?w=640&ssl=1\" alt=\"Tim Starks\"> <\/figure>\n<\/p><\/div>\n<div class=\"author-card__details\" readability=\"10.901098901099\">\n<h4 class=\"author-card__name\">Written by Tim Starks<\/h4>\n<p> Tim Starks is senior reporter at CyberScoop. His previous stops include working at The Washington Post, POLITICO and Congressional Quarterly. An Evansville, Ind. native, he’s covered cybersecurity since 2003. Email Tim here: <a href=\"mailto:tim.starks@cyberscoop.com\">tim.starks@cyberscoop.com<\/a>. <\/div>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<div class=\"popular-stories__stories\">\n<div class=\"popular-stories__cards\">\n<article class=\"post-item post-item--popular-stories-cards \" readability=\"19.192708333333\">\n<figure class=\"post-item__thumbnail\"> <a class=\"post-item__thumbnail-link\" href=\"https:\/\/cyberscoop.com\/forest-blizzard-apt28-routers-espionage-campaign-operation-masquerade\/\" tabindex=\"-1\"> <img data-recalc-dims=\"1\" loading=\"lazy\" width=\"506\" height=\"337\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-2.jpg?resize=506%2C337&ssl=1\" class=\"attachment-ratio-16-9-md size-ratio-16-9-md wp-post-image\" alt decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-6.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-6.jpg?resize=300,200 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-6.jpg?resize=768,512 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-6.jpg?resize=1024,683 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-6.jpg?resize=1536,1024 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-6.jpg?resize=600,400 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-6.jpg?resize=252,168 252w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-6.jpg?resize=506,337 506w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-6.jpg?resize=1013,675 1013w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-6.jpg?resize=1265,843 1265w\" sizes=\"auto, (max-width: 506px) 100vw, 506px\"> <\/a><figcaption class=\"screen-reader-text\"> Gwengoat, iStock\/Getty Images Plus <\/figcaption><\/figure>\n<header class=\"post-item__meta\" readability=\"3.2806324110672\">\n<h3 class=\"post-item__title\"> <a class=\"post-item__title-link\" href=\"https:\/\/cyberscoop.com\/forest-blizzard-apt28-routers-espionage-campaign-operation-masquerade\/\"> Feds quash widespread Russia-backed espionage network spanning 18,000 devices <\/a> <\/h3>\n<p> Forest Blizzard, a threat group attributed to Russia\u2019s GRU, hijacked network traffic to steal credentials and tokens for Microsoft accounts and other services. <\/p>\n<div class=\"post-item__byline\"> <span class=\"post-item__author\"> <span>By <\/span> <a class=\"post-item__author-link\" href=\"https:\/\/cyberscoop.com\/author\/matt-kapko\/\"> Matt Kapko <\/a> <\/span> <\/div>\n<p> <\/header>\n<p> <\/article>\n<article class=\"post-item post-item--popular-stories-cards \">\n<figure class=\"post-item__thumbnail\"> <a class=\"post-item__thumbnail-link\" href=\"https:\/\/cyberscoop.com\/iranian-hackers-cyberattacks-us-energy-water-infrastructure-plc-scada-warning\/\" tabindex=\"-1\"> <img data-recalc-dims=\"1\" loading=\"lazy\" width=\"224\" height=\"168\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-3.jpg?resize=224%2C168&ssl=1\" class=\"attachment-ratio-16-9-sm size-ratio-16-9-sm wp-post-image\" alt decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-7.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-7.jpg?resize=300,225 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-7.jpg?resize=768,576 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-7.jpg?resize=1024,767 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-7.jpg?resize=1536,1151 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-7.jpg?resize=600,450 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-7.jpg?resize=224,168 224w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-7.jpg?resize=450,337 450w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-7.jpg?resize=901,675 901w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-7.jpg?resize=1125,843 1125w\" sizes=\"auto, (max-width: 224px) 100vw, 224px\"> <\/a><figcaption class=\"screen-reader-text\"> Miguel Escamilla Jr., mannufacturing manager of ShayoNano, demonstrates the operation of programmable logic controller at the company\u2019s production plant July 25, 2017, in Stafford. The Singapore-based company chose Stafford to be their U.S. headquarters. (Photo by Yi-Chin Lee\/Houston Chronicle via Getty Images) <\/figcaption><\/figure>\n<header class=\"post-item__meta\">\n<h3 class=\"post-item__title\"> <a class=\"post-item__title-link\" href=\"https:\/\/cyberscoop.com\/iranian-hackers-cyberattacks-us-energy-water-infrastructure-plc-scada-warning\/\"> Iranian hackers launching disruptive attacks at U.S. energy, water targets, feds warn <\/a> <\/h3>\n<div class=\"post-item__byline\"> <span class=\"post-item__author\"> <span>By <\/span> <a class=\"post-item__author-link\" href=\"https:\/\/cyberscoop.com\/author\/tim-starkscyberscoop-com\/\"> Tim Starks <\/a> <\/span> <\/div>\n<p> <\/header>\n<p> <\/article>\n<article class=\"post-item post-item--popular-stories-cards \">\n<figure class=\"post-item__thumbnail\"> <a class=\"post-item__thumbnail-link\" href=\"https:\/\/cyberscoop.com\/fbi-cisa-issue-psa-on-russian-intelligence-campaign-to-target-messaging-apps\/\" tabindex=\"-1\"> <img data-recalc-dims=\"1\" loading=\"lazy\" width=\"252\" height=\"168\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-4.jpg?resize=252%2C168&ssl=1\" class=\"attachment-ratio-16-9-sm size-ratio-16-9-sm wp-post-image\" alt decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-8.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-8.jpg?resize=300,200 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-8.jpg?resize=768,512 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-8.jpg?resize=1024,683 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-8.jpg?resize=1536,1024 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-8.jpg?resize=600,400 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-8.jpg?resize=252,168 252w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-8.jpg?resize=506,337 506w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-8.jpg?resize=1013,675 1013w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers-8.jpg?resize=1265,843 1265w\" sizes=\"auto, (max-width: 252px) 100vw, 252px\"> <\/a><figcaption class=\"screen-reader-text\"> Anton Petrus, Getty Images <\/figcaption><\/figure>\n<header class=\"post-item__meta\">\n<h3 class=\"post-item__title\"> <a class=\"post-item__title-link\" href=\"https:\/\/cyberscoop.com\/fbi-cisa-issue-psa-on-russian-intelligence-campaign-to-target-messaging-apps\/\"> FBI, CISA issue PSA on Russian intelligence campaign to target messaging apps <\/a> <\/h3>\n<div class=\"post-item__byline\"> <span class=\"post-item__author\"> <span>By <\/span> <a class=\"post-item__author-link\" href=\"https:\/\/cyberscoop.com\/author\/tim-starkscyberscoop-com\/\"> Tim Starks <\/a> <\/span> <\/div>\n<p> <\/header>\n<p> <\/article>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/china-nexus-covert-networks-advisory\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>A dozen allied agencies say China is building covert hacker<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[271,78,452,669,2708,117,2184,288,3679,1498],"tags":[277,86,454,671,2710,119,2187,294,3682,1499],"class_list":["post-8576","post","type-post","status-publish","format-standard","hentry","category-china","category-cybersecurity","category-cybersecurity-and-infrastructure-security-agency-cisa","category-federal-bureau-of-investigation-fbi","category-flax-typhoon","category-government","category-soho","category-threats","category-uk","category-volt-typhoon","tag-china","tag-cybersecurity","tag-cybersecurity-and-infrastructure-security-agency-cisa","tag-federal-bureau-of-investigation-fbi","tag-flax-typhoon","tag-government","tag-soho","tag-threats","tag-uk","tag-volt-typhoon"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/china\/\" rel=\"category tag\">China<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybersecurity\/\" rel=\"category tag\">Cybersecurity<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybersecurity-and-infrastructure-security-agency-cisa\/\" rel=\"category tag\">Cybersecurity and Infrastructure Security Agency (CISA)<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/federal-bureau-of-investigation-fbi\/\" rel=\"category tag\">Federal Bureau of Investigation (FBI)<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/flax-typhoon\/\" rel=\"category tag\">Flax Typhoon<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/government\/\" rel=\"category tag\">Government<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/soho\/\" rel=\"category tag\">SOHO<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/threats\/\" rel=\"category tag\">Threats<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/uk\/\" rel=\"category tag\">UK<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/volt-typhoon\/\" rel=\"category tag\">Volt Typhoon<\/a>","tag_info":"Volt Typhoon","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/8576","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=8576"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/8576\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=8576"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=8576"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=8576"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":8576,"date":"2026-04-23T11:13:51","date_gmt":"2026-04-23T16:13:51","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=88726"},"modified":"2026-04-23T11:13:51","modified_gmt":"2026-04-23T16:13:51","slug":"a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2026\/04\/23\/a-dozen-allied-agencies-say-china-is-building-covert-hacker-networks-out-of-everyday-routers\/","title":{"rendered":"A dozen allied agencies say China is building covert hacker networks out of everyday routers"},"content":{"rendered":"