Cyber Centre co-signs guidance on China-linked covert networks of hacked routers
The Canadian Centre for Cyber Security joined the United Kingdom's National Cyber Security Centre and partners from eight other countries on April 23 in issuing guidance on defending against covert networks that China-linked hackers use to disguise their attacks.
These networks are made of compromised everyday devices, such as home routers and smart devices, that relay malicious traffic. Because the traffic appears to come from ordinary home and small-business connections, it is hard to block, and the infrastructure changes so quickly that indicators of compromise can vanish soon after they are published, a problem the guidance calls "IOC extinction."
What the guidance says
According to the NCSC announcement, published during its CYBERUK conference, China-linked actors now use these networks at scale to target critical sectors, steal sensitive data and keep persistent access. The networks are created and maintained by Chinese information security companies rather than by the hacking groups themselves.
The NCSC pointed to Integrity Technology Group, which it and partners named in September 2024 as controlling a botnet used by the group known as Flax Typhoon. The U.K. sanctioned Integrity Technology Group and another China-based security company in December 2025 over what it called "reckless and indiscriminate" cyber activity.
Paul Chichester, the NCSC's director of operations, said the advisory reflects "a deliberate shift" by China-based groups toward these networks to avoid accountability, and urged organizations to act now.
Who signed
The Cyber Centre's notice lists partners from Australia, Germany, Japan, the Netherlands, New Zealand, Spain, Sweden and the United States, including CISA, the FBI and the NSA, alongside U.K. industry members of the NCSC's Cyber League.
Why it matters for Canada
Many of the compromised devices are ordinary home routers and smart devices whose owners may not know they are being used. For defenders at larger organizations, the guidance means static blocklists will not catch much of this traffic. Defenders are told to adopt adaptive, intelligence-driven controls instead.
What to do
- Map and baseline normal traffic to edge devices, especially VPN and remote access connections, so unusual sources stand out.
- Use dynamic threat feeds that include known covert network indicators, and refresh them frequently.
- Replace end-of-life routers and change default passwords on home and small-office devices.
- Apply the Cyber Centre's guidance for securing edge devices and remote access.
