Joint cyber security advisory on worldwide network compromises by People’s Republic of China state-sponsored actors – Canadian Centre for Cyber Security
Summary
The Canadian Centre for Cyber Security, working with the US National Security Agency and international partners, has issued a joint advisory about widespread network compromises by PRC state-sponsored actors.
The advisory warns these actors are targeting critical sectors — telecommunications, government, transportation, lodging and military infrastructure — by focusing on large backbone routers and provider- and customer-edge routers. They use compromised devices and trusted connections to pivot deeper into networks and modify routers to keep long-term persistent access. Their primary tactics rely on exploiting publicly known vulnerabilities and avoidable configuration weaknesses.
Source
Key Points
- PRC state-sponsored actors are conducting global network compromises affecting telecoms, government, transport, lodging and military networks.
- Primary targets are large backbone routers and provider-/customer-edge routers of major telecommunications providers.
- Attackers pivot from compromised devices and trusted links into other networks, often modifying routers to maintain persistent access.
- Operations largely exploit publicly known CVEs and preventable configuration weaknesses rather than novel zero-days.
- Activity overlaps with known PRC threat groups (industry reporting names include Salt Typhoon among others).
- The advisory urges network defenders to actively hunt for malicious activity and apply recommended mitigations from the joint advisory.
- Full technical details and mitigation guidance are provided in the joint advisory PDF linked by partners.
Why should I read this?
Short version: if you run networks or rely on telecom connectivity, this advisory matters. It shows attackers are going after the plumbing of the internet — routers and edge devices — using avoidable weaknesses. Read it so you can spot the signs and patch the holes before someone else does the hard work for them.
Context and relevance
This advisory consolidates analysis from multiple intelligence authorities and highlights a trend towards targeting core network infrastructure for long-term espionage. For network operators, service providers and security teams, the guidance is timely: it reinforces the need for rigorous patching, secure configuration, network segmentation and proactive threat hunting as part of standard defence-in-depth practices.
Read the full joint advisory (technical details and mitigations): Chinese state-sponsored actors compromise networks worldwide to feed global espionage system (PDF).