Story perspectives

US, Allies Warn of China-Linked Router Botnets, Advise MFA

4/24/2026

Summary

US Allies Alert

On April 23, 2026 the United States and allies issued an advisory, 15 partners including U.K. NCSC, CISA, FBI, NSA, Australia, Canada and Germany, on China-linked networks.
It warns the networks exploit SOHO routers and cites Volt Typhoon on U.S. rail, aviation and water, Flax Typhoon, and the Raptor Train botnet that infected 200,000 devices worldwide.
Agencies advise multi-factor authentication, active hunting, blocklists, the Cyber Action Toolkit for small firms and Cyber Essentials for organizations.

Summary

FCC Blocks Routers

The U.S. Federal Communications Commission is moving to block foreign-made routers from U.S. networks after Forescout's 2026 report found routers average 32 security flaws and represent about one-third of the most critical vulnerabilities.
NCSC director of operations Paul Chichester said China-based cyber groups have shifted to covert networks to avoid accountability.
An engineer disclosed a backdoor in a robot vacuum that allowed remote control and data exfiltration to Chinese servers.

Summary

Google Dismantles Botnet

Google dismantled a residential-proxy network that let hacked home devices support cyber-crime and state-backed attacks.
Private Chinese firms built and ran the covert botnets used by Volt Typhoon and Flax Typhoon.
Flax Typhoon controls about 260,000 compromised routers, firewalls, webcams and CCTV cameras for espionage.
NCSC chief Richard Horne called China a “peer competitor in cyberspace,” warning that shared covert networks make attribution difficult.

1 of 3

US Allies Alert

On April 23, 2026 the United States and allies issued an advisory, 15 partners including U.K. NCSC, CISA, FBI, NSA, Australia, Canada and Germany, on China-linked networks.
It warns the networks exploit SOHO routers and cites Volt Typhoon on U.S. rail, aviation and water, Flax Typhoon, and the Raptor Train botnet that infected 200,000 devices worldwide.
Agencies advise multi-factor authentication, active hunting, blocklists, the Cyber Action Toolkit for small firms and Cyber Essentials for organizations.

1 / 3