Pacific Rim timeline: Information for defenders from a braid of interlocking attack campaigns

Nov. 1, 2024, 5:26 p.m.

Description

Sophos unveils a five-year investigation tracking China-based threat actors targeting perimeter devices, particularly Sophos firewalls. The report details multiple attack campaigns, including Asnarök, Bookmark Buffer Overflow, and Covert Channels, which exploited zero-day vulnerabilities to gain access and deploy various malware payloads. The attackers demonstrated sophisticated tactics, techniques, and procedures, including the use of rootkits, backdoors, and novel persistence mechanisms. The campaigns evolved from indiscriminate attacks to highly targeted operations against government agencies, critical infrastructure, and strategic industries, primarily in the Asia-Pacific region. Sophos' defensive efforts included rapid patching, threat hunting, and collaboration with international cybersecurity agencies and researchers.

Date

Published: Oct. 31, 2024, 7:46 p.m.

Created: Oct. 31, 2024, 7:46 p.m.

Modified: Nov. 1, 2024, 5:26 p.m.

Attack Patterns

Onderon

libsophos.so

Cloud Snooper

Asnarök

Moudoor

Mydoor

gh0st RAT - S0032

Sliver

Additional Informations

Technology

Healthcare

Energy

Defense

Finance

Telecommunications

Government

British Indian Ocean Territory

India

China

Japan