Dutch Intelligence: Chinese Malware Survives Firmware Patches, Compromised ...

Dutch intelligence agencies have formally forecast that Chinese state- cyberattacks on the routers, firewalls, and VPN gateways that connect organizations to the internet will increase significantly in the coming years — and they have the evidence to back it up: a previously undisclosed piece of Chinese malware that can survive firmware upgrades and that successfully compromised 20,000 network appliances worldwide before anyone knew it existed.

The Military Intelligence and Security Service (MIVD) and the General Intelligence and Security Service (AIVD) published the joint advisory on October 7, warning that edge device exploitation is not a tactic Chinese hackers occasionally use but "a specific and characteristic modus operandi of Chinese espionage groups." The forecast is the first formal Western intelligence assessment to translate a years-long pattern of Chinese edge device intrusions into an explicit prediction that those intrusions will intensify — and it arrives at a moment when AI tools are compressing the time between vulnerability discovery and weaponization to a fraction of what it once was.

For the millions of organizations that rely on Fortinet, Cisco, Palo Alto Networks, or Juniper equipment to mediate their connection to the public internet, the message from The Hague is direct: that device is a primary target, it may already be compromised, and the adversary on the other side has the patience, resources, and increasingly the AI assistance to find ways in that no defender has yet thought to look for.

Why Edge Devices Are a Structurally Privileged Attack Surface

A compromised firewall is not simply a way into a network — it is a vantage point from which an attacker can silently observe, intercept, and maneuver laterally across an entire organization without triggering the security tools deployed further inside. Edge devices occupy the single most architecturally privileged position in any enterprise network: they see all traffic entering and leaving, they authenticate remote workers, and they often carry credentials that could unlock the rest of the infrastructure.

What makes them uniquely dangerous to defend is the combination of high privilege and low observability. Unlike workstations and servers, edge devices cannot run EDR agents — the security software that modern enterprises depend on to detect and contain threats in real time. Their operating systems are proprietary and stripped-down; they offer limited logging capability; and critically, the incident logs they do generate are often stored locally on the device itself. An attacker who controls the device controls the evidence of their own presence.

The Dutch advisory makes this explicit: "incident logs are often stored locally on the devices, meaning a skilled attacker who controls the device can also control — or erase — the evidence of their own presence," the AIVD advisory confirms . That single architectural fact — that the forensic record lives inside the crime scene — is the structural reason why edge device compromises are so difficult to detect and why the 20,000-device figure from the Coathanger investigation almost certainly understates the true extent of Chinese penetration of Western networks.

How Coathanger Survives a Firmware Upgrade

The MIVD's 2024 investigation into a Chinese intrusion at a Dutch Ministry of Defence research network produced the discovery of Coathanger — and Coathanger demonstrated exactly why edge device malware represents a qualitatively different class of threat.

Coathanger is a remote access Trojan (RAT) purpose-built for Fortinet FortiGate appliances. It exploited CVE-2022-42475, a pre-authentication RCE vulnerability in FortiOS with a CVSS score of 9.3 — meaning it required no valid credentials to run arbitrary code on a target device. But the initial exploit was almost secondary to what came .

After gaining access, Coathanger deployed a second-stage payload that hooks system calls to hide its presence from security tools, then injects itself into the reboot process responsible for rebooting the system. The consequence: a device that has been patched against CVE-2022-42475, rebooted multiple times, and even subjected to a firmware upgrade will remain infected if the compromise occurred before the patch was applied. The malware name itself comes from a line from Roald Dahl's short story "Lamb to the Slaughter" that Dutch intelligence analysts found embedded in the code.

The NCSC's subsequent global investigation confirmed what the MoD breach had suggested: the campaign was not a targeted attack against one ministry but a mass-exploitation operation. At least 14,000 devices were compromised during the zero-day window — before any patch existed — and the total global figure reached at least 20,000 devices belonging to government agencies, international organizations, and defense contractors. Organizations that patched promptly may not know they were already infected.

Chinese Hackers Now Have Source Code — and AI

The October advisory describes a threat actor operating at a level of technical depth that distinguishes it from typical cybercriminal groups. According to the MIVD and AIVD advisory , Chinese state- actors invest in "in-depth knowledge of the hardware and software of these devices," conducting sustained independent research on Western products to identify flaws that neither the manufacturer nor the customer is yet aware of.

More significantly, the services assess that in some cases Chinese actors have obtained the proprietary source code of the devices they are targeting. If accurate, this means Chinese intelligence services can conduct intensive vulnerability research — the kind that once required a vendor's own engineering team — without the vendor's knowledge, systematically auditing production software for flaws that will never be reported before they are weaponized.

The role of artificial intelligence makes this already-alarming picture considerably more urgent. Both the MIVD/AIVD advisory and independent security research confirm that AI tools are now compressing the timeline between vulnerability discovery and active exploitation. Google's Threat Intelligence Group documented this trend in its review of 2025 zero-days, identifying at least ten vulnerabilities attributed to China-linked espionage groups that year — double the figure from 2024 — with a particular concentration on network appliances and security devices.

The clearest operational demonstration of AI-assisted intrusion came in a July 2026 Unit 42 investigation, which documented a campaign by a Chinese actor using DeepSeek inside Hermes Agent to scan targets, select exploits, and initiate attacks with minimal human direction. The campaign attempted intrusions against 460 or more targets and successfully exfiltrated data from at least three organizations. Among the vulnerabilities exploited was CVE-2026-3055 in Citrix NetScaler — an edge device.

Only a Limited Proportion Is Ever Detected

One of the most consequential passages in the MIVD and AIVD's advisory is also its most sobering: the services state plainly in their advisory that "only a limited proportion of Chinese cyber operations against Dutch interests is detected and subsequently mitigated," and that detection, response, and mitigation "are often inadequate against the extensive and professional Chinese cyber threat."

That statement, read alongside the Coathanger findings, points toward a specific and deeply uncomfortable conclusion: the 20,000-device compromise figure is not a complete accounting of Chinese penetration. It is a lower bound — the number investigators were able to identify through active forensic work on a specific campaign, conducted after the intrusion was already discovered. The devices that went undetected because their logs were erased, or because no one thought to look, or because the compromise happened months before anyone knew to , do not appear in that number.

CrowdStrike's 2026 Global Threat Report reinforces this assessment from a different angle: in at least one documented case, a China-linked adversary maintained access for 22 months after initial compromise through edge infrastructure. The report found that China-nexus operations increased 38 percent in 2025, and that edge devices were the target in 40 percent of intrusions where a China-linked actor exploited a vulnerability.

The MIVD's April 2026 annual report had already stated what no Western intelligence agency had previously said publicly: that China " probably stands on equal footing with the United States in the area of offensive cyber capabilities." That assessment, combined with the structural detection gap in edge device security, means that organizations cannot rely on detecting an intrusion before it causes damage. The recommended posture — consistent with the National Cyber Security Centre's guidance — is to assume breach: to architect networks and responses on the assumption that some edge devices are already compromised, and to build defenses accordingly.

Salt Typhoon Already Hit Dutch Networks

The October advisory does not emerge from theoretical threat modeling. Chinese state- actors have already demonstrated their willingness to target Dutch civilian infrastructure at a scale that goes well beyond the Ministry of Defence.

In August 2025, Dutch intelligence confirmed that Salt Typhoon — the Chinese state- group also known as Earth Estries, which has breached more than 600 organizations in 80 countries since 2019 — accessed routers of Dutch ISPs and hosting providers. The breach did not result in confirmed deep-network penetration of the Dutch ISPs themselves, but it demonstrated that Chinese intelligence operations against the Netherlands extend beyond government and defense to the commercial internet infrastructure that ordinary Dutch citizens and businesses depend on.

Salt Typhoon's global footprint — breaching 600 organizations across 80 countries since 2019 — reflects the same structural preference that the Dutch advisory describes: the group targets edge devices not as an end in themselves but as persistent vantage points from which to observe and access the broader networks that flow through them. The combination of dwell time, stealth, and the EDR visibility gap means that victims may not know for months or years that their traffic has been observed.

Beijing has pushed back against the October advisory through its standard diplomatic channel. A Chinese foreign ministry spokesperson urged Dutch authorities to "objectively and rationally evaluate China's efforts to combat cyberattacks and to stop baseless accusations under the pretext of cybersecurity," calling for "international cooperation based on respect, equality, and reciprocity."

The response tracks a pattern now well established in Dutch-Chinese cyber diplomacy. When the AIVD's spring 2026 annual report declared Chinese offensive cyber capability on par with the United States, Beijing similarly characterized the assessment as politically motivated. Every Dutch public attribution of Chinese cyber activity since the February 2024 Coathanger disclosure has been met with denial. The October 7 advisory's forward-looking forecast — that attacks will increase — drew an identical .

What Does AI Change the Timeline?

For organizations trying to assess their exposure, the most practically significant dimension of the Dutch warning may be the AI component. Defenders have historically operated on the assumption that the window between a vulnerability becoming known and its weaponization provides some margin for patching. That assumption is increasingly wrong.

The traditional timeline runs roughly as follows: a researcher discovers a vulnerability, the vendor develops a patch, a patch is released, administrators schedule and apply the patch, and attackers reverse-engineer the patch to develop an exploit. That sequence historically provided days to weeks of defensive runway after a vulnerability became public knowledge.

AI-assisted reconnaissance and exploit development is compressing each step in that sequence. The Unit 42 findings from July 2026 showed an AI agent — not a human operator — scanning targets and selecting exploits from public databases autonomously, in a loop that required no human expertise at the moment of execution. For zero-day vulnerabilities identified through source-code analysis before any patch exists, the timeline is even shorter: there is no patch window at all.

The 13-country joint advisory from August 2025, which attributed a separate set of campaigns to three Chinese technology companies acting on Beijing's behalf, described the same fundamental pattern: state-backed actors with access to sophisticated technical resources, targeting network perimeter devices as their primary entry point. What the October 2026 Dutch advisory adds to that picture is the explicit forecast that AI tools will make those campaigns faster, more numerous, and harder to preempt.

How to Reduce the Attack Surface

The Dutch advisory, developed jointly with the NCSC, provides concrete defensive guidance for organizations operating edge devices. The services acknowledge that intrusions cannot always be fully prevented, but assess that the success rate "can be considerably reduced" through layered, proactive defenses.

Patch promptly. Security updates should be applied as quickly as operationally feasible. The Coathanger campaign's impact was dramatically amplified by the gap between CVE-2022-42475's disclosure and the patch deployment timelines at thousands of affected organizations. The advisory notes a real operational tension — not all updates can be deployed immediately without testing — but emphasizes that delayed patching is the single most predictable enabler of successful exploitation.

Build defense-in-depth. A compromised edge device should not be a key that unlocks the entire network. Organizations should implement multi-factor authentication, strict network segmentation, and layered access controls so that an attacker who penetrates the perimeter cannot immediately reach sensitive systems. The blast radius of a perimeter breach must be structurally bounded.

Centralize logging. Because incident logs stored locally on edge devices can be manipulated or erased by an attacker in control of the device, organizations must route logs to a centralized, independently protected system. This is not optional for organizations that want forensic visibility after a compromise: a sophisticated attacker will not leave local evidence intact.

Train for forensic response. The advisory specifically recommends that organizations train personnel and conduct periodic exercises in digital forensic investigation. Given the detection gap described throughout the advisory, the question is not whether an intrusion will occur but whether the organization will be able to reconstruct what happened and contain the damage when it does.

Frequently Asked Questions

What is the Coathanger malware and why is it so difficult to remove?

Coathanger is a remote access Trojan (RAT) purpose-built to compromise Fortinet FortiGate network appliances. It was discovered by Dutch intelligence following a 2023 intrusion at the Ministry of Defence. What makes Coathanger particularly persistent is its survival mechanism: the malware injects a copy of itself into the process responsible for rebooting the device. Standard remediation approaches — rebooting and applying a firmware upgrade — do not remove it. A device that was compromised before its administrator applied the FortiOS patch for CVE-2022-42475 may remain infected indefinitely unless specifically subjected to forensic investigation and remediation, regardless of how many times it has been patched or restarted since.

Why can't organizations simply use standard security software to detect these attacks on edge devices?

Standard enterprise security depends heavily on endpoint detection and response (EDR) software — agents installed on devices that monitor behavior, detect anomalies, and alert security operations centers in real time. Edge devices (routers, firewalls, VPN gateways) run proprietary, stripped-down operating systems that cannot host EDR agents. Their logging capabilities are limited, the logs they produce are typically stored locally and can be erased by an attacker who has compromised the device, and some devices use in-memory file systems that erase forensic evidence entirely on reboot. This structural visibility gap is precisely why Dutch intelligence describes Chinese edge device operations as so difficult to detect — and why organizations are advised to assume some devices are already compromised rather than waiting for an alert that may never come.

What is the connection between AI and the growing threat to edge devices?

AI tools are compressing the timeline from vulnerability discovery to active exploitation in two ways. First, autonomous agent frameworks like the one documented by Unit 42 in July 2026 — which used the DeepSeek AI platform to scan hundreds of targets and select and deploy exploits without continuous human direction — allow a single actor to conduct campaigns at a scale and speed that previously required much larger teams. Second, Dutch intelligence assesses that Chinese actors use AI to conduct independent vulnerability research on Western products, identifying flaws in proprietary firmware before vendors are aware of them. Combined with the evidence that Chinese actors in some cases have access to vendor source code, this means the effective zero-day window — the period during which a vulnerability exists but no patch is available — may be extended indefinitely on the attacker's side.

Which Dutch organizations have already been affected by Chinese edge device attacks?

The confirmed Dutch incidents include the Dutch Ministry of Defence's research-and-development network (breached in 2023 via Coathanger, affecting fewer than 50 users in an isolated network, publicly disclosed February 7, 2024) and an unspecified number of small Dutch ISPs and hosting providers whose routers were accessed by Salt Typhoon in a campaign confirmed by Dutch intelligence in August 2025. Dutch intelligence has explicitly stated that only a limited proportion of Chinese cyber operations against Dutch interests are ever detected, which means the confirmed incidents represent a minimum, not a complete accounting.