Executive Summary: Defending against China-nexus covert networks of compromised devices What is the threat? China-nexus cyber actors have moved from using individually procured infrastructure to operating large scale “covert networks” – botnets built from compromised routers, and other edge devices. These networks are used for each phase of the Cyber Kill Chain, from reconnaissance and malware delivery, to command and control and data exfiltration against targets of espionage and offensive cyber operations. The threat is a dynamic, low-cost, deniable infrastructure model that can be rapidly re-shaped, rendering traditional static IP block lists ineffective. What is the impact on affected organisations? Covert networks enable China-nexus actors to launch cyber attacks against UK…