State-sponsored cyber actors in China are threatening critical infrastructure using a covert network of compromised devices, the Cybersecurity and Infrastructure Security Agency warned in an advisory Thursday.
CISA and partner organizations in the UK, Germany, Japan and other countries said in the advisory that groups such as Volt Typhoon and Flax Typhoon use hijacked home or small office devices known as botnets to spy and steal data. In 2024, a network known as Raptor Train, infected more than 200,000 devices worldwide, the FBI found.
“Covert networks are used to connect across the internet in a low-cost, low-risk, deniable way, disguising …
