china-linked

China-linked state actors have systematically compromised backbone and edge networking equipment, including provider-edge routers and customer-facing devices, to build a global espionage capability. These attacks steal subscriber metadata, intercept authentication traffic, and create persistent covert collection paths across peering and transit links. Adversaries weaponize unpatched, Internet-facing network infrastructure by abusing built-in router features such as SPAN/ERSPAN, Embedded Packet Capture, Guest Shell/containers, SNMP, and TACACS+/RADIUS. They also exploit network trust relationships to capture communications. The coordinated international advisory highlights the urgent need for mitigations against these China-linked threats targeting core routers.