CISA 2026-04-23

Defending Against China-Nexus Covert Networks of Compromised Devices

Machine-generated analysis · WAYSCloud LLM

This joint advisory details a shift toward using large-scale compromised device networks for routing malicious traffic. The guidance focuses on detecting and mitigating infrastructure-based TTPs rather than specific product vulnerabilities.

Context

This is a multi-national advisory on defending against China-nexus cyber actors using covert networks of compromised devices. The advisory explains a shift in tactics toward leveraging compromised infrastructure to route malicious activity. It is jointly released by CISA, NCSC-UK, and 13 other international agencies.

Operator considerations

Check: Network infrastructure for signs of unauthorized routing or proxy behavior
Isolate: Suspect devices or networks exhibiting abnormal outbound traffic patterns
Log: Unusual proxy, VPN, or tunneling activity from internal devices

From Cybersecurity and Infrastructure Security Agency ↗

Defending against china-nexus covert networks of compromised devices

executive summary

Defending against China-nexus covert networks of compromised devices

Explaining the widespread shift in tactics, techniques and procedures (TTPs) towards networks of compromised infrastructure, and how to defend against it

With support from the UK Cyber League, this advisory has been jointly released by the National Cyber Security Centre (NCSC-UK) and international partners:

Australian Signals Directorate’s (ASD’s) Australian Cyber Security Centre (ACSC)

Communications Security Establishment Canada’s (CSE’s) Canadian Centre for Cyber Security (Cyber Centre)

Germany Federal Office for the Protection of the Constitution - Bundesamt für Verfassungsschutz (BfV)

Germany Federal Intelligence Service – Bundesnachrichtendienst (BND)

Germany Federal Office for Information Security - Bundesamt f...

Read the full advisory on CISA →