China's Router Army: How Grandma's WiFi Became a Spy Tool Plus AI Hacks an 8-Year-Old Bug in Minutes

This is your Digital Dragon Watch: Weekly China Cyber Alert podcast. Hey listeners, Alexandra Reeves here with Digital Dragon Watch, your weekly China cyber alert. Over the past seven days ending April 24, 2026, the big story exploding across headlines is China-linked hackers industrializing massive botnets of compromised SOHO routers and IoT devices to mask their ops. According to a joint advisory from the US CISA, UK's NCSC, and allies like Australia, Canada, Germany, Japan, the Netherlands, New Zealand, and Spain, these state-backed actors are scaling up covert networks for reconnaissance, malware drops, and data exfil targeting critical sectors worldwide. These aren't your grandma's botnets—they're dynamic, low-cost swarms where hackers hop through hundreds of thousands of endpoints, dodging IP blocks by constantly rotating in fresh compromised gear. Dark Reading reports China's groups are treating this like a factory line: infect everyday home routers, then proxy attacks for deniability. Sectors hit hardest? Think telecoms, energy, and government, with persistent access for espionage. No major breaches named this week, but the advisory flags these networks as the new vector, evolving from sporadic use to strategic scale. US government response was swift and multilateral. CISA dropped the advisory on April 23, urging orgs to map networks, baseline normal traffic, and enforce MFA on remote links. High-risk spots get zero-trust mandates: IP allowlisting, SSL certs, and segmentation to starve these proxies. Cybersecurity Dive notes evidence points to Chinese firms like those in Beijing actually building and maintaining these networks for the PRC—talk about dual-use tech gone rogue. On the AI front, Anthropic's Claude Mythos preview, announced April 7, lit a fire under China's cyber scene. South China Morning Post says shares of Qi An Xin, Sangfor Technologies, and 360 Security Technology spiked as investors bet on AI arms race. 360 Digital Security Group bragged about their Multi-Agent system nabbing CVE-2026-32190—a critical eight-year-old Office flaw—in minutes, topping Tianfu Cup. SecurityWeek compares it to Mythos-level vuln hunting, though Microsoft credits Taiwan and South Korea for another kernel bug, CVE-2026-24293, casting shade on 360's claims. Expert recs? NCSC and CISA push proactive hunts: patch routers, segment IoT, monitor for anomalous outbound traffic. "Static blocklists are dead," the advisory warns—go dynamic with threat intel feeds. For you defenders, prioritize SOHO gear audits and behavioral analytics to spot the hoppers. Stay vigilant, listeners—this Dragon's breath is getting hotter with AI-fueled precision. Thanks for tuning in to Digital Dragon Watch—subscribe now for weekly drops. This has been a Quiet Please production, for more check out quietplease.ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta This content was created in partnership and with the help of Artificial Intelligence AI.