International Cyber Agencies Release Joint Advisory to Counter China-Linked Covert Networks
Key Takeaways
- ▸International cyber agencies from 10 countries, led by GCHQ's NCSC, have released joint guidance to combat China-linked covert networks made of compromised IoT devices and edge devices
- ▸These covert networks are used at scale by China-linked threat actors to obscure malicious cyber activity and avoid attribution while targeting critical sectors globally
- ▸IOC extinction is a critical challenge where indicators of compromise disappear quickly, requiring adaptive, intelligence-driven mitigation strategies rather than signature-based defenses
Summary
The UK's National Cyber Security Centre (NCSC), part of GCHQ, has released a comprehensive joint advisory alongside 15 international partners from nine countries to help organizations defend against covert networks used by China-linked threat actors. These networks, typically composed of compromised everyday internet-connected devices such as home routers and smart devices, are being weaponized at scale to target critical sectors globally, steal sensitive data, and maintain persistent access while obscuring the origins of cyber attacks.
The advisory highlights a critical challenge for network defenders: IOC (Indicator of Compromise) extinction, where detection signatures disappear rapidly as they are discovered, requiring more adaptive and intelligence-driven defensive measures. The guidance was released during the CYBERUK 2026 conference and reveals how China-linked cyber groups have deliberately shifted tactics to utilize these covert networks to avoid accountability. The advisory notes that Chinese information security companies are externally creating and maintaining these botnets, with specific examples including Integrity Technology Group, which was sanctioned by the UK government in December 2025 for its involvement in malicious cyber activity.
Organizations of all sizes are encouraged to implement the protective measures outlined in the advisory. Small organizations can use the free Cyber Action Toolkit, while larger enterprises are urged to pursue Cyber Essentials certification and leverage the updated Cyber Assessment Framework. The NCSC and its international partners—including agencies from Australia, Canada, Germany, and others—emphasize that understanding and defending against these covert network tactics is critical for protecting national security and critical infrastructure.
- The advisory identifies Chinese information security companies as the external creators and maintainers of these botnets, with recent examples including Integrity Technology Group which was sanctioned in December 2025
Editorial Opinion
This joint international advisory represents an important collective effort to expose and counter sophisticated Chinese cyber tactics, but the fundamental challenge remains implementation. The emphasis on IOC extinction and the need for more adaptive defenses acknowledges a harsh reality: traditional reactive cybersecurity measures are increasingly inadequate against well-resourced, state-sponsored actors. Organizations, particularly smaller ones with limited resources, may struggle to transition from signature-based detection to the intelligence-driven approaches recommended here, highlighting a potential gap between advisory guidance and practical capabilities.
