China-linked threat actors are compromising SOHO routers and IoT devices at scale to build covert proxy networks used to conduct espionage against critical infrastructure. By routing operations through thousands of geographically distributed consumer and small-business devices, attackers defeat IP-based blocking and attribution. Any organization relying on network perimeter controls alone faces elevated risk of undetected intrusion and data theft.