In October 2026, Dutch intelligence agencies warned that Chinese state-sponsored actors were increasingly exploiting internet-facing devices such as routers, firewalls and VPN gateways. Their assessment followed the discovery of Coathanger, a Chinese-linked malware implant that compromised at least 20,000 Fortinet devices worldwide and could survive firmware upgrades. The malware had been identified during an investigation into an intrusion at a Dutch Ministry of Defence research network.
The discovery points to a change in how Chinese cyber operations are being conducted. The objective is no longer limited to stealing information from a particular organisation and leaving behind traces of an intrusion. Increasingly, the focus is on gaining access to the infrastructure through which organisations communicate, preserving that access and using it to reach other networks. Recent campaigns involving telecommunications providers, critical infrastructure and cloud services suggest that Chinese-linked actors are building a more durable presence across the digital systems on which governments and businesses depend.
From stealing data to securing a foothold
The Coathanger malware was designed to compromise Fortinet FortiGate network security appliances, exploiting a vulnerability in FortiOS. What made it particularly difficult to remove was its ability to modify the device's reboot process and maintain its presence even after firmware upgrades. Dutch investigators found that the campaign had compromised at least 14,000 devices during the period before a patch became available, with the global total subsequently assessed at more than 20,000.
Network appliances occupy a privileged position between an organisation and the wider internet. They manage incoming and outgoing traffic, support remote access and can provide attackers with a route into internal systems. Unlike conventional computers, many such devices offer limited security monitoring and do not support the endpoint detection tools organisations commonly use. A compromised appliance can therefore remain difficult to identify even when the organisation believes it has installed the necessary updates.
The Dutch Military Intelligence and Security Service and General Intelligence and Security Service have warned that Chinese actors conduct detailed research into Western hardware and software, sometimes obtaining access to proprietary source code to identify vulnerabilities. Their October advisory also noted that artificial intelligence is helping accelerate the discovery and exploitation of these weaknesses
This suggests a more systematic approach towards intrusion tactics. Instead of waiting for a vulnerability to become publicly known, well-resourced actors can study the technology used by their targets and search for weaknesses before manufacturers and customers are aware of them. A vulnerability in a widely deployed network appliance can provide access to thousands of organisations using the same product.
Building networks that conceal the attacker
The second development concerns how Chinese-linked actors conceal their operations. In April 2026, the US National Security Agency, Britain's National Cyber Security Centre and Australian cyber authorities issued a joint advisory warning that multiple China-linked groups were using networks of compromised routers, firewalls, network-attached storage devices and internet-connected equipment to conduct cyber operations.
These networks, often described as covert botnets, allow attackers to route malicious activity through devices belonging to ordinary businesses and individuals. This makes it harder to identify where an attack originated and complicates efforts to block the infrastructure being used. The agencies also noted that these networks are frequently rebuilt or modified following defensive action, making conventional methods of tracking and dismantling them less effective.
The significance is that compromised devices are no longer merely entry points into individual networks. They can become part of the infrastructure used to conduct subsequent attacks. A router in one country might be used to conceal activity directed at a government department in another. The owner of the device may have no knowledge that their equipment has been recruited into a wider operation.
This is particularly relevant to the campaign attributed to Volt Typhoon, which US agencies have described as a Chinese state-sponsored operation targeting critical infrastructure networks. Its operators were found using compromised routers and other devices, alongside legitimate administrative tools, to avoid attracting attention. The approach, commonly known as living off the land, makes malicious activity harder to distinguish from routine network administration. The concern surrounding Volt Typhoon was not confined to information theft. US authorities assessed that the group was positioning itself within critical infrastructure networks, potentially to enable disruptive operations during a future crisis.
The expanding attack surface of trusted networks
Telecommunications infrastructure offers another example of how these operations are developing. The Salt Typhoon campaign, attributed by US and allied authorities to Chinese state-linked actors, compromised telecommunications networks in several countries. In the United States, investigators found that attackers had accessed systems used for lawful interception, potentially exposing communications and information associated with government officials and other targets.
The operation demonstrated the intelligence value of compromising the systems through which communications pass. Rather than targeting only individual devices or email accounts, attackers gained access to the networks and systems that carry information across organisations and borders. Such access can reveal patterns of communication, relationships between individuals and potentially sensitive government activity. The campaign also exposed weaknesses in telecommunications infrastructure that had been designed around assumptions of trusted access and established security procedures.
More recent activity suggests that the same logic is extending into cloud services and software supply chains. In October 2026, Microsoft reported that Storm-0940, a China-state-aligned group, had used an artificial intelligence-driven penetration testing framework called ARTEX to automate attacks against hundreds of organisations. Microsoft linked the group to the ConnectWise supply-chain compromise and reported that the campaign targeted sectors including defence, energy, finance, government, manufacturing and semiconductors.
The attackers used automated reconnaissance, password spraying and the abuse of existing application permissions to gain access to cloud environments. In several instances, privileged access was obtained in less than three hours. Microsoft also recorded more than 151,000 failed login attempts during one part of the campaign, illustrating the scale at which automated operations can be conducted. Not every attempted intrusion succeeded, and the presence of unauthorised authentication did not necessarily mean that data had been stolen. Nevertheless, the campaign demonstrated how a compromise involving a trusted service provider can create risks for multiple downstream organisations.
A problem extending beyond individual breaches
These developments have implications beyond the immediate targets of Chinese cyber operations. Modern economies depend on interconnected systems in which telecommunications providers, cloud platforms, software vendors and network equipment manufacturers support thousands of organisations. A vulnerability in one widely used product can therefore create exposure across an entire sector. A compromise of a service provider can also provide access to customers who may have maintained their own security systems carefully.
For governments, this creates a difficult security problem. Traditional responses often focus on identifying malicious software, patching vulnerabilities and blocking known attacker infrastructure. But these measures become less effective when attackers can survive firmware upgrades, use legitimate credentials, conceal their activity through compromised devices and return through newly established networks. Cybersecurity can no longer be treated as a matter of protecting individual computers or government databases. It requires greater attention to the infrastructure and third-party services on which those systems depend.
China's cyber capabilities should also be understood within the wider context of its intelligence and strategic objectives. Espionage remains a central purpose, particularly when access can provide information about defence planning, diplomatic negotiations, technological development and critical industries. The potential to disrupt infrastructure during a geopolitical crisis adds another dimension, although the presence of an implant does not establish that an attack is planned or imminent.
The more consequential change is the growing emphasis on persistence. Chinese-linked actors are seeking access that can survive technical remediation, remain concealed within ordinary network activity and provide routes into interconnected systems. Coathanger, Salt Typhoon, Volt Typhoon and the more recent cloud supply-chain campaign differ in their targets and methods, but each illustrates the strategic value of access that extends beyond a single breach.
For governments and businesses, the challenge is no longer simply to keep attackers out. It is to recognise when they may already be inside, understand the infrastructure they have compromised and ensure that removing one vulnerability does not leave the wider network exposed. In cyber operations, gaining access is only the beginning. The greater advantage belongs to the actor capable of retaining it without being noticed.
