On 23 April 2026, the UK’s National Cyber Security Centre (NCSC), part of GCHQ, with 15 international cyber agencies from nine countries, released a joint advisory detailing defensive measures against China-linked covert networks. These networks, composed of compromised everyday internet-connected devices like home routers and smart devices, are used at scale by China-based threat actors to obscure origins of cyber attacks, target critical sectors globally, steal sensitive data, and maintain persistent access. The advisory highlights the challenge of indicator of compromise extinction and stresses intelligence-driven mitigation. It also details involvement of Chinese information security firms, specifically naming Integrity Technology Group, linked to botnet operations and sanctioned by the UK government in December 2025. The advisory urges organizations to use defensive tools such as the Cyber Action Toolkit and Cyber Essentials certification to protect assets. This joint effort was announced at the UK government’s CYBERUK 2026 conference, consolidating insights from agencies including US CISA, FBI, NSA, Germany’s BSI and BND, and others.

On 23 April 2026, the UK’s National Cyber Security Centre (NCSC), part of GCHQ, with 15 international cyber agencies from nine countries, released a joint advisory detailing defensive measures against China-linked covert networks. These networks, composed of compromised everyday internet-connected devices like home routers and smart devices, are used at scale by China-based threat actors to obscure origins of cyber attacks, target critical sectors globally, steal sensitive data, and maintain persistent access. The advisory highlights the challenge of indicator of compromise extinction and stresses intelligence-driven mitigation. It also details involvement of Chinese information security firms, specifically naming Integrity Technology Group, linked to botnet operations and sanctioned by the UK government in December 2025. The advisory urges organizations to use defensive tools such as the Cyber Action Toolkit and Cyber Essentials certification to protect assets. This joint effort was announced at the UK government’s CYBERUK 2026 conference, consolidating insights from agencies including US CISA, FBI, NSA, Germany’s BSI and BND, and others.