China-Linked Cyber Actors Turn to Massive Covert Botnets to Evade Detection

Why It Matters

The evolution to large‑scale, dynamic botnets raises the risk of undetected espionage and sabotage against critical infrastructure, forcing organizations to overhaul traditional perimeter‑based security models.

Key Takeaways

• China-Nexus actors now run botnets of 200k+ compromised devices.
• Botnets mask origins, making IP blocklists ineffective.
• Volt Typhoon and Flax Typhoon use these networks for espionage.
• Outdated SOHO routers are primary infection vectors.
• Zero‑trust and active threat hunting recommended to mitigate risk.

Pulse Analysis

The strategic pivot toward sprawling covert botnets marks a watershed moment in state‑sponsored cyber‑espionage. By commandeering millions of everyday devices—home routers, smart cameras, and other IoT endpoints—China‑Nexus groups create a fluid, multi‑hop infrastructure that can route malicious traffic through dozens of compromised nodes before reaching a target. This architecture not only obscures attribution but also allows rapid reconfiguration, as seen with the “Raptor Train” network that infected over 200,000 devices in 2024 and the KV Botnet leveraged by Volt Typhoon against aging Cisco and NetGear routers. The scale and diversity of these botnets amplify the attack surface for critical sectors such as energy, finance, and telecommunications.

Traditional defenses that rely on static indicators of compromise are losing effectiveness against this moving target. As compromised devices are patched or taken offline, new nodes are added, rendering IP blocklists and signature‑based detection obsolete. Security teams now face "IOC extinction," where known malicious fingerprints disappear faster than they can be disseminated. This dynamic environment demands continuous threat‑intelligence feeds, behavioral analytics, and machine‑learning models capable of spotting anomalous traffic patterns across heterogeneous device fleets. Moreover, the presence of legitimate users on the same compromised infrastructure complicates attribution and response, raising the stakes for incident‑response teams.

Mitigating the botnet threat requires a shift to a zero‑trust mindset and proactive hunting. Organizations should maintain exhaustive inventories of edge devices, enforce multi‑factor authentication, and replace blocklists with allow‑list policies for remote access. Deploying geographic and behavioral profiling can flag suspicious connections originating from consumer broadband ranges. Advanced measures—such as SSL machine certificates, micro‑segmentation, and AI‑driven anomaly detection—provide additional layers of resilience. Coordinated efforts between government agencies, ISPs, and device manufacturers are essential to patch legacy hardware and disrupt the supply chain that fuels these covert networks, safeguarding the broader digital ecosystem.