A 2026 BGP Hijack Campaign Against Chinese ISPs: Forged Origins, Then Forged Paths
Between June 10 and October 14, 2026, two ASNs ran a campaign against Chinese ISP address space using two different techniques. First they forged origins on 13 /24s inside China Mobile, China Unicom and China Telecom space. Then, from July 19, they stopped touching the origin at all and forged AS paths instead, placing AS402425 above real carrier origins: six China Unicom aggregates, then 1,294 China Mobile prefixes in one snapshot, then a plateau that shrank from 225 prefixes to 76 and stopped after October 14.
The interesting part is not the size. It is that the second technique is invisible to everything the first technique was defended against. Origin validation has nothing to check when the origin is a real carrier ASN and only the provider edge is invented.
This post is a condensed version of a longer report, which is available as a PDF: Incident report IR-2026-1106. This is revision 2 of the PDF, correcting the legend of the daily-series figure. Everything below comes from public BGP archives: RIPE RIS and RouteViews MRT files, the RPKI history archive, RDAP, and IRR objects.
What we found
- Two techniques, one campaign. Forged origins from June 10 to July 7, forged paths from July 19 to October 14. The origin-based view sees only the first phase.
- Thirteen /24s, none of them with a ROA. Origin validation could not reject what it was never told about. Today 12 of the 13 are RPKI-invalid and one still has no covering ROA.
- Scale changed by two orders of magnitude. Phase one moved /24s of 256 addresses each. The first day of phase two moved six aggregates totalling about 1.44 million addresses; August 1 reached 1,294 prefixes.
- The carrier changed with the phase. IPTP for the June bursts and the July 19 probe, peers at the Singapore IXes for the July 6 burst, six upstreams at once on August 1, and Cogent from August 18 onward.
- It stopped, and we can date it. 76 prefixes every day from September 29 to October 14, then nothing in any snapshot through November 6.
How we looked, and what we got wrong first
Two filters do the work. An origin filter matches announcements whose origin ASN is AS402425 or AS198474. A path filter matches an AS path regular expression for either ASN anywhere in the path.
Our first pass used only the origin filter, and it ended the campaign on July 7. That reading was wrong: it was measuring the technique, not the campaign. Switching to the path filter added four months of activity that no origin-based watch can see.
For the origin phase we replayed every five-minute update file on 12
days plus hourly sampling across the window. For the path phase we used
one RIB snapshot per day at rrc00, 00:00 UTC, 150 snapshots from June 10
to November 6. Both series are floors, not censuses.
Phase one: forged origins, June 10 to July 7
13 /24s inside three Chinese carriers, announced in bursts of minutes across 26 observed days. None of them had a ROA, so origin validation had nothing to reject.
| Prefix | Origin | First seen | Holder of the covering space |
|---|---|---|---|
| 117.180.191.0/24 | AS402425 | Jun 10 | AS9808 China Mobile |
| 163.177.91.0/24 | AS402425 | Jun 10 | AS17816 China Unicom Guangdong |
| 219.128.130.0/24 | AS402425 | Jun 10 | AS4134 China Telecom |
| 219.128.128.0/24 | AS198474 | Jul 6 | AS4134 China Telecom |
| 219.128.129.0/24 | AS198474 | Jul 6 | AS4134 China Telecom |
| 219.128.131.0/24 | AS198474 | Jul 6 | AS4134 China Telecom |
| 219.128.132.0/24 | AS198474 | Jul 6 | AS4134 China Telecom |
| 27.40.0.0/24 | AS198474 | Jul 6 | AS17816 China Unicom Guangdong |
| 58.247.118.0/24 | AS198474 | Jul 6 | AS17621 China Unicom Shanghai |
| 112.64.143.0/24 | AS198474 | Jul 6 | AS17621 China Unicom Shanghai |
| 112.65.184.0/24 | AS198474 | Jul 6 | AS17621 China Unicom Shanghai |
| 218.107.49.0/24 | AS198474 | Jul 6 | AS17622 China Unicom Guangzhou |
| 180.108.0.0/24 | AS198474 | Jul 6 | AS4134 China Telecom |
The mechanics are the familiar more-specific case. A /24 sits inside a live aggregate, the aggregate stays in place, and the more specific wins wherever it is accepted. In the 16:00 UTC snapshot on June 15, all five prefixes AS402425 originated were visible at three collectors over about 20 distinct paths, every one through IPTP: its three Chinese /24s and the two leased /24s it also announced.
The phase took two shapes. Across the 26 days AS402425 announced its three
Chinese /24s through IPTP in bursts of minutes. On July 6 the other ASN
took over: AS198474 originated ten /24s with AS402425 one hop above it,
arriving through peers at the Singapore IXes, for example
133210 402425 198474. That burst ended at 19:36:14 UTC, when both ASNs
stopped in the same second. The ten /24s were still up in the July 7
snapshot, no longer through those peers but through AS6939 and other
transit.
Figure 1. Announced hours per day during the origin phase. Bars are the 12 days replayed at five-minute resolution; hollow markers are the 14 further days that hourly sampling catches and an 8-hour RIB census misses.
Two numbers frame the phase. The median announcement lasted 5.5 minutes and the longest single announcement by one peer was 138 minutes, while the aggregate time announced across the 12 replayed days reaches 83 hours. That is a campaign of many short bursts, not one sustained announcement.
One /22 inside China Telecom’s space was split between the two ASNs: three /24s by AS198474 and one by AS402425, with a fifth /24 immediately outside the /22. 1,280 addresses changed origin while the carrier’s aggregate did not.
Figure 2. 219.128.128.0/22 split between the two ASNs, plus 219.128.132.0/24 just outside it.
Figure 3. Two path shapes from the origin phase, above, and the shape neither an origin nor a prefix query sees, below: a real carrier origin with a forged edge above it.
Phase two: forged paths, July 19 to October 14
From July the origin stays legitimate and only the provider edge is
invented. The first path we catch, on July 19, is
852 41095 402425 4837: AS402425 inserted between IPTP and China Unicom.
The origin is a real carrier ASN, so its validation verdict does not
change.
One peer, AS852, reported all six prefixes, and the hop below AS402425 is AS4837, China Unicom, which legitimately originates Unicom space. Origin validation inspects only the origin ASN, so it returns the same verdict for these prefixes as it did before the announcement, and has nothing to reject.
The six prefixes are aggregates, not /24s: 112.80.0.0/13,
122.192.0.0/14, 123.138.0.0/15, 36.248.0.0/14, 58.240.0.0/15 and
60.28.0.0/15, about 1.44 million addresses in total. Phase one moved 256
addresses per prefix; the first day of phase two moved aggregates.
Figure 4. Daily series at rrc00, 00:00 UTC, log scale. Blue counts
prefixes originated by AS402425, the dotted line counts the ten /24s
AS198474 originated on July 6, and red counts prefixes whose path contains
AS402425 while the origin is one of the Chinese carriers.
The red series is a sequence of discrete appearances, not a curve: 60 of the 150 daily snapshots carry it. The first episode is the July 19 probe above. The second is a single day. On August 1 one snapshot carries 1,294 China Mobile prefixes, and the real upstreams above AS402425 change too: six at once, Converge AS17639 carrying 1,294 prefixes, AS38001 1,292, AS24482 1,289, and AS9930, AS8966 and AS33891 below that.
The third episode starts on August 18 and lasts longest. The route returns with 225 prefixes, now through Cogent (AS174), and holds 223 to 224 a day until September 9. From September 10 it steps down: 204, then 85, then 80, then 76 at the end of the month. These snapshots cannot tell whether the route was withdrawn, filtered upstream, or moved outside the 00:00 sample.
The plateau is one fixed set, not a rotation. Across the 23 days from August 18 to September 9 the union of the daily sets is exactly 225 prefixes, the same as the largest single day, and no day adds a prefix that August 18 did not already contain. What changes is only how many of that fixed set survive.
Why the usual controls did not catch it
Phase one is the only phase an origin check can catch, and only where the
targets have ROAs. All 13 returned NotFound in June and July, so
there was nothing to reject.
IRR-based prefix filters would reject a phase-one /24 with no route object. In phase two the origins are the carriers’ own, so the filter has to come from the carriers’ own objects; the attacker’s AS sets, which name both ASNs and six China Mobile ASNs, are not a legitimate filter source for those origins.
Upstream filtering would remove an episode where it is applied: IPTP for June and the July 19 event, Converge and other transit paths on August 1, Cogent from August 18. Each change of carrier moves the filtering point to another network, and our snapshots do not say whether filtering ended any episode.
ASPA, or any form of path validation, is the only control that addresses phase two, because it constrains which AS may appear as a provider. Coverage was 2.98% of origin ASNs on September 17, according to the external analysis we discuss below.
De-peering at one exchange would have cut the July 6 burst, which arrived through peers there, but not the June bursts through IPTP or anything in phase two.
What it does not tell us
No traffic was measured. Every impact statement here is about routing state: where packets could have gone, not how many did. DNS manipulation, which CNCERT reported, sits outside every public BGP archive.
The path phase is a snapshot series. A technique that runs for hours and
stops is caught only if it overlaps 00:00 UTC on the day sampled, so both
series are lower bounds. The daily series uses one collector; rrc23 and
route-views.sg confirm individual days but were not swept daily.
We also cannot say why it stopped on October 14. The route may have been withdrawn, filtered upstream, or moved to a different hour than our sample.
What other people reported
CNCERT published a report on October 20 about gambling-site redirects in
several Chinese provinces, placing the tampering inside AS402425 and
referring to forged prefixes and forged AS sets registered in routing
registries. It does not publish prefixes, timestamps or AS paths, and it
does not name the sets. Three sets with these maintainers do exist and
were created in August and September, after the origin phase:
AS402425:AS-CUSTOMERS, AS402425:AS-CONE and AS198474:AS-ALL, whose
members include six China Mobile ASNs. That they are the sets CNCERT meant
is an inference, not a quotation.
A CAICT warning reported in industry press adds an injection point at Equinix Singapore. Kentik described the same AS as a suspected front for a North Korean group on November 6 and recommended de-peering, without publishing a technical evidence chain. An independent analysis from September 18 describes four phases and counts up to 23,000 prefixes behind forged paths.
Those counts sit 7 to 18 times above our 1,294 in one snapshot, and the difference needs an explanation, because a reader who meets 13 /24s here and 23,000 there will assume one of the two numbers is wrong. The three counts measure three different things. 13 is the number of distinct /24s whose origin was forged in phase one, so it counts address blocks. 1,294 is the number of prefixes whose path carried AS402425 on August 1 while the origin stayed a Chinese carrier ASN, so it counts affected prefixes in one snapshot at one collector. The 9,000 and 20,000 are cumulative: every prefix seen behind a forged path at any hour and any collector in the stated window.
We keep our definition because it is reproducible and because it fails in a known direction. Two disagreements no definition can absorb: we never observe Hurricane Electric directly above AS402425 on a Chinese carrier path on any of the 60 active days, and we place the end later than that window, with 76 prefixes every day from September 29 to October 14.
The campaign end we can measure sits close to the CNCERT report. Our series carries China Mobile prefixes behind AS402425 until October 14 and nothing afterward, six days before CNCERT published.
Reproducing this
Every number above comes from public files and open-source tools. For one origin-phase day, one prefix, five-minute updates:
monocle search -t 1781481600 -d 24h -D updates -c rrc23 \
-p 117.180.191.0/24 -f prefix,as_path,peer_asn,timestampFor one path-phase snapshot:
monocle search -t 1785542400 -d 1s -D rib -c rrc00 -a '.*402425.*' \
-f prefix,as_path,peer_asnROAs in force on a past date come from the BGPKIT historical RPKI API:
curl "https://api.bgpkit.com/v3/roas/search?prefix=163.177.91.0/24&date=2026-06-15&exact=false"The full report has five appendix queries, the per-prefix table with registration records, and the external claims each with what they do not establish: IR-2026-1106, PDF.