Executive Summary: Defending against China-nexus covert networks of compromised devices

UK NCSC publications (Apr 2026) warn of a shift toward covert networks of compromised edge devices (China‑nexus activity) used to hide malicious traffic and persistence. Organisations should map and baseline edge device traffic (especially routers, VPN and remote‑access services), apply dynamic threat‑feed filtering for known covert‑network indicators, and segment/monitor east‑west and egress traffic. NCSC also highlights active threats and high‑risk vulnerabilities: APT28 router exploitation enabling DNS hijacking, and recently disclosed critical issues affecting F5 BIG‑IP APM and Citrix NetS