Imagine one morning there is a knock on your door. Upon opening it, two police officers show you a search warrant and ask for permission to enter the kitchen. They are not looking for drugs, weapons, or documents. They are looking for the fridge.
It is noon on a Saturday in a quiet town in western Germany. A young couple lives in the house. The police point to a state-of-the-art smart refrigerator: touchscreen, interior cameras to check from their phone what is missing in the groceries, and permanent internet connection. They bought it a year earlier convinced that this technology would make their lives a bit more comfortable. They never imagined that this appliance would end up being part of an international investigation for Chinese cyber espionage.
While the fridge continued to cool food and alert when the milk ran out, it had been following orders from someone thousands of kilometers away for months.
For several hours, a team of specialists photographed each component of the fridge, cloned the internal memory, and disassembled it piece by piece before transferring it to a forensic laboratory. According to the investigators, that appliance was part of an immense network of hijacked devices by a group of hackers sponsored by the Chinese government. But neither the appliance nor the couple were the ultimate target of the espionage.
The house was near an electrical substation and an important telecommunications node used by a state-owned company. The attackers linked routers, home surveillance cameras, smart appliances, and other connected devices until they built a digital route that was difficult to trace. When they tried to access the operator's network, the apparent origin of the attack was not a server in Asia, but a mundane IP address belonging to a German residence.
The scene, reconstructed from investigations by several European cybersecurity services, summarizes the silent transformation that international espionage is undergoing. For decades, infiltrating a ministry required recruiting an official, placing a hidden microphone, or bribing a diplomat. Today, all it takes is finding a forgotten vulnerability in an internet-connected fridge.
"The investigators determined that the attack had been coordinated by a group of Chinese hackers. And it was by no means the first time," reveals an intelligence official from the European Union delegation in Beijing, summarizing one of the main concerns of Western intelligence services.
"The threat no longer consists solely of trying to penetrate directly into the systems of a government, an electric company, or a military installation. Before reaching them, attackers can take a much more discreet path through millions of household devices scattered around the world," he continues. A fridge, a vacuum robot, a surveillance camera, or a router can become, without their owners knowing, the first link in an invisible chain that ends up leading to a critical infrastructure.
This is precisely the scenario described this year by a common front formed by the main intelligence agencies of the Five Eyes alliance (United States, United Kingdom, Canada, Australia, and New Zealand) along with the security services of Spain, Germany, Japan, the Netherlands, and Sweden. Their conclusion was clear: China has elevated cyber espionage to a new dimension. It is no longer limited to stealing information or industrial secrets. It is building a permanent infiltration capacity on Western infrastructures using tens of thousands of consumer electronic devices as covert platforms from which to hide their movements.
"Chinese operators remain very interested in political and industrial espionage, but they have become much more sophisticated," shares Adam Segal, director of the Digital and Cyberspace Policy program at the Council on Foreign Relations and one of the leading American specialists in Chinese technological strategy. "Unlike a decade ago, they no longer rely solely on massive information theft or phishing campaigns. They now exploit unknown vulnerabilities - the so-called zero days -, use legitimate tools installed in the systems being attacked to go unnoticed, and turn millions of internet-connected devices into intermediate steps to hide the origin of their operations."
Segal explains that in the cybersecurity world, this technique is called living off the land: the attacker tries to leave as little trace as possible using the victim's own resources. It is as if a thief managed to enter a house without breaking a single window or forcing the lock, simply by using the keys found inside the house. The less noise it makes, the longer it remains hidden.
And time is precisely the main goal. "The problem is no longer just about stealing information," warns Segal. "What is truly concerning is their ability to remain inside critical infrastructures for months, and even years, without being detected."
One of the devices that most worries cybersecurity experts, in addition to spy fridges, are vacuum robots. Unlike other connected appliances, these devices not only access the internet: they also roam all the rooms of a house equipped with cameras, sensors, and systems capable of creating extremely precise three-dimensional maps of the interior of a house.
In recent years, vulnerabilities have been discovered in several commercial models that allowed remote control of the device, access to its cameras, or activation of its microphones. In 2024, there were even several cases in the US where these smart vacuums started chasing pets and insulting their owners through their speakers after hackers took control of the devices.
One of the researchers who has studied these risks the most is the German Dennis Giese, known for his security reports on vacuum robots from brands like the Chinese Xiaomi. Giese demonstrated that an attacker could access the robot's operating system, remotely activate the camera and microphone, obtain complete floor plans of the house, and even the credentials of the wifi network.
"The problem is that these devices are computers on wheels," he says. "If they fall into the hands of a state-sponsored espionage group, they cease to be a floor-cleaning robot and become a discreet surveillance platform capable of mapping the interior of a house and observing everything that happens inside without raising suspicions."
The proliferation of these devices also worries Bruce Schneier, an American cryptographer and one of the world's leading cybersecurity experts. He has been warning for years that the so-called Internet of Things - the universe of fridges, TVs, vacuum robots, cameras, or locks connected to the network - has multiplied the weak points that cybercriminals or intelligence services can exploit. "The problem is that most of these devices were designed with the user's convenience in mind, not to protect against a cyber attack," he argues.
Behind this new form of espionage is a much deeper change that worries Washington and the main European capitals. For Beijing, the cyberspace has ceased to be solely a terrain for stealing technology. Under Xi Jinping's mandate, it has become a new battlefield, as strategic as the Taiwan Strait, the South China Sea, or the race for semiconductors.
Spain has not been left out of this silent war either. Although the vast majority of operations never become public, the National Cryptologic Center, under the CNI, has been warning for years about the increase in campaigns targeting public bodies, strategic companies, and operators of critical infrastructures. At the beginning of 2025, the Spanish government accelerated the renovation of encryption systems protecting the communications of the president and top officials of the State due to the growing threat level.
Experts point out that Chinese intelligence services, the People's Liberation Army, universities, technology companies, and state-sponsored hacker groups are part of the same ecosystem whose mission is to gain technological advantage and collect sensitive information. Reports from the Five Eyes alliance indicate the existence of a true family of specialized groups serving Beijing's strategic interests.
One of the most well-known is Volt Typhoon, which Washington links to the Chinese army. For years, it has focused its efforts on infiltrating electrical grids, water supply systems, ports, telecommunications, and other critical infrastructures.
Its obsession does not seem to be causing immediate damage, but remaining hidden for as long as possible. Researchers believe that, in the event of a military clash around Taiwan, these access points could be used to slow down the American response and sow chaos in the early stages of the conflict.
Another active group is Flax Typhoon, which uses huge networks of compromised household devices to conceal the origin of its attacks. Last September, the FBI announced the dismantling of a network consisting of more than 260,000 internet-connected devices - from surveillance cameras to routers - that was being used by this group to launch espionage operations against governments and companies in several countries. The third identified group, Violet Typhoon, works for the Ministry of State Security, the main Chinese intelligence service. Unlike the previous ones, these hackers focus their efforts on parliaments, political parties, and all kinds of Western organizations.
In 2021, they managed to access the systems of the British Electoral Commission for months, compromising the personal data of around 40 million voters. Among those affected were also several lawmakers particularly critical of Beijing. Decades ago, espionage consisted of hiding a microphone under a table or recruiting a government official. Today, it can also start in the kitchen of any home. While a fridge cools food, a robot vacuum memorizes every corner of the living room, and a home camera watches the front door, another silent war may be unfolding without anyone noticing.