APT31 Abuses Compromised Routers to Conceal China-Linked Cyber Operations

Key Takeaways

• China-linked threat actors are actively exploiting compromised routers and edge devices globally to create sophisticated, covert networks.
• These networks are used to mask the origins of cyber operations across all stages of the Cyber Kill Chain, from reconnaissance to data exfiltration.
• The dynamic nature of these networks, with constantly changing compromised nodes, renders traditional, static defenses like IP blocklists largely ineffective.
• The UK’s NCSC, in collaboration with partners, issued an advisory on April 23, 2026, detailing this evolving threat and recommending advanced, dynamic mitigation strategies.

China-Linked APTs Exploit Global Routers to Mask Cyber Operations

A rapidly evolving and significant cyber threat has emerged, with state-sponsored hackers attributed to China establishing extensive networks of compromised routers and edge devices. These covert infrastructures are subsequently leveraged to conduct clandestine cyber operations against organizations worldwide, according to a recent comprehensive report.

Instead of investing in and developing proprietary infrastructure, these sophisticated threat actors have adopted a more efficient and cost-effective strategy. They are systematically breaching common networking equipment, including consumer-grade home routers and small office devices, transforming them into relay points for their attacks. This methodology allows malicious traffic to blend seamlessly with legitimate internet activity, significantly complicating efforts for defenders to trace attacks back to their true origin. The result is a robust, concealed network that is continuously shifting, making it exceedingly difficult to pinpoint using conventional security tools.

The Dynamic Shield of Covert Networks

The sheer scale and inherent flexibility of these hidden networks present a formidable danger. China-nexus actors are now utilizing these compromised devices at every phase of the Cyber Kill Chain. From initial scanning and reconnaissance to malware delivery, command and control communications, and ultimately data exfiltration, each step of an attack can be routed through seemingly innocuous devices. This strategic obfuscation means that an attack might appear to originate from a residential network in one country one day, and an entirely different geographical location the next, defying static attribution.

The UK’s National Cyber Security Centre (NCSC), working alongside co-sealing partner agencies and the Cyber League, identified this escalating threat pattern and published an advisory on April 23, 2026. Their analysis revealed that these covert networks are not exclusive to a single group; rather, multiple China-linked threat actors share and continually refresh the same pool of compromised nodes. This shared access and constant reconfiguration lead to what the NCSC terms “IOC extinction,” where indicators of compromise—the digital breadcrumbs typically used by defenders—become obsolete almost as quickly as they are discovered. Further details can be found in the associated report.

The ramifications for targeted organizations are severe. Sensitive data faces increased risk of theft, and critical services could experience significant disruption, all while the attackers operate with near-perfect anonymity behind a façade of hacked consumer devices. Organizations that rely solely on static defensive measures, such as fixed IP block lists, are particularly vulnerable, as the underlying infrastructure of these attacks never remains constant long enough for such lists to be effective. This marks a fundamental shift in how large-scale cyber espionage operations are executed.

How the Covert Network Operates as a Shield

The fundamental mechanism behind this threat is deceptively straightforward yet tactically brilliant. When China-nexus actors aim to compromise a target, they do not establish a direct connection from a known server. Instead, they funnel their malicious traffic through a chain of pre-compromised routers and IoT devices, frequently belonging to ordinary households or small businesses. These devices are often running obsolete firmware and harbor unpatched vulnerabilities, making them prime targets for initial exploitation. Once access is gained, attackers deploy minimal tools that silently forward traffic along the chain, leaving scant traces on the compromised device itself. More technical details are available in the report.

Given that the devices comprising the network are in constant flux, the infrastructure self-regenerates automatically.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.