Chinese state-sponsored hackers exploit TP-Link routers with custom malware

Malicious firmware has been discovered that can turn residential and small office routers into a network that relays traffic to command and control servers maintained by Chinese state-sponsored hackers. The firmware implant contains a full-featured backdoor that allows attackers to establish communications and file transfers with infected devices, remotely issue commands, and upload, download, and delete files. The malware's ultimate purpose is to relay communication between two nodes, creating a chain of nodes that will relay traffic to the command and control server, making it difficult for defenders to trace the traffic back to the C2.