IC Technology & Surveillance — 2026-04-24

NSA and Five Eyes Partners Issue Joint Advisory on China-Nexus Covert Infrastructure Networks

The NSA, the United Kingdom's National Cyber Security Centre, and the Australian Signals Directorate's Australian Cyber Security Centre on April 23 released a joint Cybersecurity Advisory titled "Defending against China-nexus covert networks of compromised devices." The advisory details how multiple China-nexus threat actors are using botnets of compromised small office/home office routers, firewalls, network-attached storage, and IoT devices to disguise the origin and attribution of malicious cyber activity at scale. The agencies warn that legitimate users browse through the same compromised infrastructure, complicating attribution, and that existing network inventories become ineffective as the covert networks are regularly updated to evade defensive or legal action.

Analysis
AA26-113A documents a tactical shift toward routing hostile traffic through compromised SOHO routers, firewalls, and IoT devices also traversed by legitimate users, rendering attribution unreliable at scale. Per the NSA's primary release, corroborated by CyberScoop's secondary framing against the broader Typhoon campaign series, the simultaneous publication of ICS advisories signals phased disclosure rather than a single-publication cycle. Follow-up advisories or sector-specific guidance from CISA, FBI, or NSA very likely arrive within the next six months, an assessment upgraded from likely after weighting the Volt, Flax, and Salt Typhoon pattern, where each campaign generated follow-on products within weeks of initial disclosure. The advisory's emphasis on compromised-device infrastructure may equally signal degraded Five Eyes collection against Chinese cyber operations; if defending agencies cannot attribute traffic through these networks, the advisory is partly an admission of an intelligence gap dressed as defensive guidance.

2 sources