Executive Summary: Defending against China-nexus covert networks of compromised devices

April 23, 2026 · NCSC UK · Severity: MEDIUM

Organisations should map and baseline their edge device traffic, especially VPN and remote access connections, and adopt dynamic threat feed filtering that includes known covert network indicators.

Key Takeaways

International cyber agencies share fresh advice on defending against China-linked covert networks of compromised devices.
China-nexus threat actors have shifted tactics toward networks of compromised devices for persistent covert access.
Organizations should implement network monitoring, device hardening, and access controls to defend against China-linked compromises.