China-nexus threat actors Volt Typhoon and Salt Typhoon are actively compromising SOHO routers and IoT edge devices at scale to construct residential proxy botnets used for espionage and offensive cyber operations. The campaign exploits misconfigured and end-of-life edge hardware across all vendors using default credentials, exposed management interfaces, and hidden firmware functionality rather than a single disclosed CVE. Any organization with unmanaged or consumer-grade edge hardware in its network boundary is a candidate target.