What the NCSC's China-linked botnet alert means for a small business

What the NCSC's China-linked botnet alert means for a small business is mostly about the kit on the edge of your network. The alert names a China-based company for enabling attacks on organisations worldwide, partly through large botnets built from hacked internet-connected devices. So check the router and firewall you already own this week, starting with updates and passwords.

What the alert says in plain words

On 8 October 2026 the NCSC published China-linked malicious actors called out by UK and international partners for targeting sensitive data globally. It says Integrity Technology Group, "a company based in China with links to the Chinese Government", has enabled cyber actors to compromise networks around the world and steal confidential data.

According to the NCSC, those actors use AI tools such as automated scanning. They also use "large-scale botnets and manual exploitation techniques". The joint advisory was co-sealed with agencies from six other countries and is published on the FBI's IC3 website. The NCSC says the activity is consistent with campaigns publicly known as Flax Typhoon, among other names.

The page is written for security professionals and large organisations. It still says "all organisations should take note of this warning".

Why small firms matter here

The alert itself doesn't list device types. For that, it links back to the NCSC's September 2024 notice, which exposed Integrity Tech as the operator of a botnet. That notice defines a botnet as internet-connected devices "infected with malware and controlled by a group to conduct co-ordinated cyber attacks without the owners' knowledge".

The compromised devices in 2024 included routers and firewalls. They also included webcams and CCTV cameras. The NCSC said new devices were recruited using known vulnerabilities, and it highlighted the risk from unpatched and end-of-life equipment. So the threat to a small office isn't only being a target. Its own router can become part of the attack on someone else.

That is why the boring kit matters. Think of the broadband router and the VPN box. Cameras and the NAS count too if they can be reached from the internet, and so does a network printer.

A this-week checklist

Each item below comes from NCSC guidance for smaller organisations. The Small Business Guide is the plain starting point. The Cyber Essentials requirements (version 3.3) give the specific rules.

• Find what is exposed: list each device that faces the internet. Cyber Essentials says inbound connections should be blocked by default, and any inbound firewall rule must be approved and documented with its business need. Remove rules you no longer need.
• Patched and still supported: Cyber Essentials says software must be licensed and supported, with automatic updates on where possible. High-risk or critical fixes must go on within 14 days of release. That covers router and firewall firmware too.
• Default passwords changed: the requirements say to change any default or guessable password. For firewalls and routers, that means a strong, unique admin password, or remote admin turned off entirely.
• Remote admin off or restricted: the admin page of a router or firewall shouldn't be reachable from the internet. Cyber Essentials allows an exception only with a documented business need and a control such as multi-factor authentication or an IP allow list.
• End-of-life kit replaced: unsupported software must be removed or cut off from the internet. If the maker no longer ships fixes for a camera or NAS, plan its replacement.
• MFA on VPN and remote access: Cyber Essentials says to always use multi-factor authentication for admin accounts, and for accounts that can be reached from the internet.

If you're working towards certification, our guide to Cyber Essentials for small businesses covers the scheme itself. Cameras and visitor devices are also safer on their own network, as explained in separate guest Wi-Fi from the office network.

When to get help

Get help if nobody can say which devices face the internet. The same goes if your router came from an installer who has since moved on, or you suspect a device is past its support date. What the NCSC's China-linked botnet alert means for a small business in that position is a short review before anything else.

Our security audit can review firewall rules and router configuration. Remote access is in scope, and so are leaver access and lost devices. You get a plain-English report with a prioritised fix list, then a retest once the fixes are in. It helps you prepare for Cyber Essentials but doesn't certify. The difference from a pen test is set out in security audit vs penetration test.

If the kit itself needs replacing, our networking team works across London and the South East. A survey comes first, then a written scope and a fixed price for the job. Installations are covered for twelve months, and monthly support with monitoring is available. Whether UniFi will do or you need Cisco or Meraki is covered in when UniFi is enough.

If you'd rather someone checked your edge kit with you, talk to an engineer. Tell us roughly what sits between your office and the internet.