The United Kingdom's National Cyber Security Centre (NCSC-UK) and international partners warned that China-nexus hackers are increasingly using large-scale proxy networks of hijacked consumer devices to evade detection and disguise their malicious activity.

BleepingComputer

The UK's NCSC and international partners from 10 countries have issued a joint advisory warning that Chinese state-sponsored hacking groups are increasingly routing attacks through large botnets of hijacked consumer devices — primarily SOHO routers, IoT cameras, and NAS devices — to evade detection. These proxy networks allow attackers to chain traffic through multiple compromised nodes, making geographic-based blocking ineffective. Notable examples include the Raptor Train botnet (260,000+ devices, linked to Flax Typhoon) and KV-Botnet (linked to Volt Typhoon). Defenders are advised to adopt MFA, zero-trust controls, dynamic threat feeds, and IP allowlists rather than relying on static IP blocklists.

UK warns of Chinese hackers using proxy networks to evade detection