Cybersecurity — 2026-04-24
Twelve Allied Cyber Agencies Warn of China-Linked Covert Hacker Networks
The joint advisory (CISA aa26-113a) covers two distinct China-nexus threat clusters: Flax Typhoon, whose Raptor Train botnet, operated by
Analysis
The 12-agency advisory scope, spanning Five Eyes plus Germany, Japan, South Korea, and Taiwan, confirms that the Flax and Volt Typhoon botnet campaigns have achieved a geographic footprint broad enough to trigger a coordinated allied defensive response rather than individual national advisories. The advisory's simultaneous release alongside ICS-specific companion documents indicates CISA is staging a phased disclosure campaign, consistent with the pattern of prior Five Eyes advisories generating sector-specific follow-up products within weeks. The Integrity Technology Group attribution reinforces the January 2025 Treasury sanctions, providing operational detail linking a named Chinese commercial entity to state-directed cyber infrastructure at a scale exceeding 260,000 compromised devices.
The 12-agency advisory scope, spanning Five Eyes plus Germany, Japan, South Korea, and Taiwan, confirms that the Flax and Volt Typhoon botnet campaigns have achieved a geographic footprint broad enough to trigger a coordinated allied defensive response rather than individual national advisories. The advisory's simultaneous release alongside ICS-specific companion documents indicates CISA is staging a phased disclosure campaign, consistent with the pattern of prior Five Eyes advisories generating sector-specific follow-up products within weeks. The Integrity Technology Group attribution reinforces the January 2025 Treasury sanctions, providing operational detail linking a named Chinese commercial entity to state-directed cyber infrastructure at a scale exceeding 260,000 compromised devices.
4 sources
- A dozen allied agencies say China is building covert hacker networks out of everyday routers -
CyberScoop - International cyber agencies share fresh advice to defend against China-linked covert networks -
UK NCSC - Security agencies say Chinese hackers using hijacked networks for large-scale cyberattacks -
Washington Times - Defending Against China-Nexus Covert Networks of Compromised Devices -
CISA