Flax Typhoon

The cyber risk landscape for 2026 is heavily influenced by regional conflicts, with PRC actors pre-positioning in critical infrastructure edge devices for strategic leverage. Russian actors are escalating hybrid warfare and OT/ICS disruption across Europe, while Iranian groups have decentralized to conduct wiper attacks and target cloud infrastructure. Concurrently, eCrime actors are exploiting these geopolitical tensions to deploy ransomware and infostealers, increasingly targeting hypervisors and industrial operations.

2026-05-134 minNCSChigh

An international coalition of cyber agencies has issued a joint advisory warning that China-linked threat actors are leveraging covert networks of compromised edge devices to disguise their attacks. The advisory highlights the growing problem of 'IOC extinction' and urges organizations to shift towards dynamic threat filtering and behavioral baselining of edge device traffic to maintain effective defense.

2026-05-134 minNCSChigh

China-nexus cyber actors have strategically shifted to utilizing large-scale covert networks of compromised SOHO and IoT devices to obfuscate their operations. These dynamic botnets, such as Raptor Train and KV Botnet, facilitate deniable access and complicate traditional static IOC-based defense, requiring organizations to adopt behavioral baselining and dynamic threat intelligence.

2026-05-134 minCISAhigh

China-nexus threat actors are increasingly utilizing large-scale covert networks of compromised SOHO routers and IoT devices to obfuscate their operations and route malicious traffic. This strategic shift renders traditional static IOC blocklists ineffective, requiring defenders to adopt behavioral profiling, zero trust principles, and active network hunting to detect multi-hop proxy traffic.