People’s Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations

The Federal Bureau of Investigation, Cyber National Mission Force, and National Security Agency assess that People’s Republic of China-linked cyber actors have compromised thousands of Internet-connected devices, including small office/home office routers, firewalls, network-attached storage, and Internet of Things (IoT) devices, with the goal of creating a network of compromised nodes (a “botnet”) positioned for malicious activity. The actors may then use the botnet as a proxy to conceal their identities while deploying distributed denial of service attacks or compromising targeted U.S. networks.