Pacific Rim timeline: Information for defenders from a braid of interlocking attack campaigns
Nov. 1, 2024, 5:26 p.m.
Tags
External References
Description
Sophos unveils a five-year investigation tracking China-based threat actors targeting perimeter devices, particularly Sophos firewalls. The report details multiple attack campaigns, including Asnarök, Bookmark Buffer Overflow, and Covert Channels, which exploited zero-day vulnerabilities to gain access and deploy various malware payloads. The attackers demonstrated sophisticated tactics, techniques, and procedures, including the use of rootkits, backdoors, and novel persistence mechanisms. The campaigns evolved from indiscriminate attacks to highly targeted operations against government agencies, critical infrastructure, and strategic industries, primarily in the Asia-Pacific region. Sophos' defensive efforts included rapid patching, threat hunting, and collaboration with international cybersecurity agencies and researchers.
Date
Published: Oct. 31, 2024, 7:46 p.m.
Created: Oct. 31, 2024, 7:46 p.m.
Modified: Nov. 1, 2024, 5:26 p.m.
Attack Patterns
Onderon
libsophos.so
Cloud Snooper
Asnarök
Moudoor
Mydoor
gh0st RAT - S0032
Sliver
Additional Informations
Technology
Healthcare
Energy
Defense
Finance
Telecommunications
Government
British Indian Ocean Territory
India
China
Japan