As a followup post, here are some other institutions who have published their own commentary on the #OperationPacificRim research that @SophosXOps published today:

The FBI posted a bulletin seeking more information about the people behind the intrusions (Sophos has identified at least some of the individuals who were involved):

https://www.fbi.gov/wanted/seeking-info/edge-device-intrusions

The UK's National Cybercrime Centre (NCSC) published their own research into malware they called #PygmyGoat (and which we named as "libsophos.so" in our report timeline (links to PDF):

https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/pygmy-goat/ncsc-mar-pygmy-goat.pdf

My former Sophos colleague Kristin Del Rosso previously coauthored an article for the Atlantic Council on China-originated device intrusions as a direct result of this research:

https://www.atlanticcouncil.org/in-depth-research-reports/report/sleight-of-hand-how-china-weaponizes-software-vulnerability/

@WIRED reporter @agreenberg published a great summary of the attack campaign:

https://www.wired.com/story/sophos-chengdu-china-five-year-hacker-war/

Cybersecurity firm Greynoise also published their research. Greynoise has been a consistently supporting org.

https://www.greynoise.io/blog/the-persistent-perimeter-threat-strategic-insights-from-a-multi-year-apt-campaign-targeting-edge-devices

If you haven't yet read Andy Greenberg's (@agreenberg) article on #OperationPacificRim, now's your chance.

https://www.wired.com/story/sophos-chengdu-china-five-year-hacker-war/

Inside Sophos' 5-Year War With the Chinese Hackers Hijacking Its Devices

Sophos went so far as to plant surveillance β€œimplants” on its own devices to catch the hackers at workβ€”and in doing so, revealed a glimpse into China's R&D pipeline of intrusion techniques.

WIRED

For those who don't know (which is most of you), this project has been the intense focus of my work, taking up a huge amount of my time, energy, and investigative effort for the past 14 months - while still helping others at Sophos publish their research; running an election campaign where I was a candidate for school board; speaking at Blue Hat, @defcon #Saintcon, #VirusBulletin and other conferences; guest lecturing to classes at CU Boulder; volunteering my time canvassing for political candidates; serving as a docent at the @mediaarchaeologylab; working as a poll worker during the current US election cycle; and starting up the Elect More Hackers (electmorehackers.com) organization.

Whew. It's actually kind of daunting just to read that. I also sometimes sleep and eat.

@SophosXOps has been, at its core, an institution that values radical transparency, and this story (and the earlier research investigations into the Operation Pacific Rim threat actors and incidents) demonstrates Sophos' commitment to truth and journalistic integrity, following a story wherever it leads.

I hope our publication today starts a larger conversation and collaboration within the cybersecurity industry - inside and outside the Cyber Threat Alliance, which Sophos actively supports and where I am proud to represent my employer - to work together to thwart the ambitions of nation-state threat actors such as the perpetrators of Operation Pacific Rim, in order to protect the privacy and safety of everyone, everywhere.

#PacificRim #OperationPacificRim #malware #china #hacking #hacks #infosec #firewalls #intrusiondetection

https://www.sophos.com/en-us/content/pacific-rim

Sophos' Pacific Rim: Defense Against Nation-state Hackers

Discover Sophos' Pacific Rim defense against nation-state / Chinese hackers Volt Typhoon, APT31, and APT41 targeting critical infrastructure.

SOPHOS