Sophos lifts the lid off a vast Chinese cyberespionage operation
Today, we’ve unveiled a defensive and counter-offensive operation with multiple interlinked nation-state adversaries based in China.
In our research named “Pacific Rim,” we disclose how the attackers used a series of campaigns with novel exploits and customized malware to conduct surveillance, sabotage and cyberespionage. Sophos also found overlapping tactics, tools and procedures (TTPs) with well-known Chinese nation-state groups, including Volt Typhoon, APT31 and APT41. The adversaries targeted both small and large critical infrastructure and government targets, primarily located in South and South-East Asia, including nuclear energy suppliers, a national capital’s airport, a military hospital, state security apparatus, and central government ministries.
Throughout Pacific Rim, Sophos X-Ops, our cybersecurity and threat intelligence unit, worked to neutralize the adversaries’ moves and continuously evolved defenses and counter-offensives.
After Sophos successfully responded to the initial attacks, the adversaries escalated their efforts and brought in more experienced operators. Sophos subsequently uncovered a vast adversarial ecosystem.
Ross McKerchar, CISO at Sophos, warns that critical infrastructure and #SMBs in the supply chain remain key targets. “Collaboration across sectors is vital to disrupt these long-term, complex attacks.”
For years, nation states have known that network devices are privileged, powerful and unmonitored places to hide, which is why radical transparency about vulnerabilities and patches and migrating End of Life (EOL) devices to modern technology is essential. The security industry needs to come together to create the changes necessary to stop fueling nation-state cyberattacks.
Read the full story here: https://bit.ly/4hvp0uT
