China's 5+ Year Campaign to Penetrate Perimeter Network Defenses

China's 5+ Year Campaign to Penetrate Perimeter Network Defenses

Speaker: Andrew Brandt, Principal Threat Researcher, Netcraft (formerly Sophos XOps)

Conference: Black Hat USA 2025 — August 6-7, 2025, Mandalay Bay, Las Vegas

YouTube: https://www.youtube.com/watch?v=z4COrX9YHcU

Reading Time: ~10 minutes

Type: Briefing

TL;DR

Over five years, Chinese state-linked threat actors mounted a sustained, evolving campaign against Sophos XG firewalls — and by extension, every major network perimeter device. Sophos responded by deploying its own covert kernel implant on attacker-controlled firewalls to monitor the adversaries in real time, ultimately linking the operations to APT41 and APT31 and to a named individual, Guan Tianfeng of Sichuan Silence Information Technology, who now carries a $10 million U.S. government bounty.

Introduction

Firewalls are the crown jewels of network defense — the devices meant to keep everyone else out. What happens when the firewall itself becomes the attack surface? Andrew Brandt's "Firewalls Under Fire" is the exhaustively documented story of what Sophos calls Pacific Rim: a multi-year, multi-phase Chinese espionage campaign that targeted Sophos firewalls, evolved in sophistication after each defensive response, and ultimately crossed into targeting nuclear regulators, Uyghur diaspora organizations, and civilian critical infrastructure.

The talk is unusual by Black Hat standards — deliberately narrative rather than purely technical — because, as Brandt explains, the story and its geopolitical context are inseparable from the research findings. Attacks like these have not stopped. They continue against every major firewall vendor today.

Phase One: The Infiltration of Sophos Itself (2018)

The campaign began not with an attack on customers, but on Sophos as a company. After acquiring Pune-based CyberRoam — whose technology would become the SFOS operating system underpinning the XG Firewall — Sophos security operations discovered a small computer attached to the back of a sales team TV monitor displaying a leaderboard.

▶ Watch: The CyberRoam Intrusion Discovery (04:00)

The device contained a rootkit and a tool named Snoopy, a deep packet inspection engine that tunneled exfiltrated data back through the same TCP connections it arrived on — effectively hiding data theft inside legitimate web traffic. Snoopy operated by monitoring source port numbers of inbound packets, using them as coded instructions. When analysts disassembled the tool, they found Chinese-language debug messages, a C2 domain that referenced China's country TLD, and an encryption key derived from the phrase "Replace with your password." The implant also included a Windows DLL that made no sense on the Linux systems where it was found — a clue the campaign involved a broader infrastructure than this single intrusion.

The attackers' broader operation during this period also deployed the Cloud Snooper technique against Amazon AWS cloud servers: a rootkit that piggybacked stolen data on normal HTTP/HTTPS connections, rendering cloud-level firewalls blind to the exfiltration.

Phase Two: The Mass Attack Era — Asnarok and Its Successors (2020)

The campaign entered its most public phase in April 2020, when a Sophos customer submitted a screenshot showing Linux shell commands inside a firewall configuration field — specifically code pulling from sophosfirewallupdate.com, a domain Sophos did not own.

▶ Watch: The Asnarok Attack Unfolds (08:00)

Brandt named this attack Asnarok. Postmortem analysis revealed the attack vector had been submitted to Sophos's bug bounty program just one day before the mass exploitation began — a pattern that would recur throughout the campaign. The attackers exploited a SQL injection vulnerability to execute arbitrary code, downloading a Linux script that modified the firewall's internals and dropped a payload called 2Own that stole local configuration data, encrypted with the password "Gucci."

The attacker also left a dead-man switch: an empty file on the firewall that, when deleted by a Sophos Hotfix, triggered a callback to a URL named RagnarokFromAsgard. The ransomware payload that would have deployed had the exploit succeeded called itself VeryHotFix — a winking reference to Sophos's update mechanism. Critically, this was the first ransomware Brandt had ever encountered that included Chinese locale settings in its safety exclusion list alongside Russian, implying the authors wrote it and wanted to avoid running it on their own machines.

A breakthrough came quickly: Dutch authorities seized the server hosting the RagnarokFromAsgard domain. Sophos's subsequent investigation revealed the server's logs showed connections from thousands of Sophos firewalls worldwide — and also from small business and home routers connecting to the same site. This discovery led to Sophos's most aggressive counter-move.

Sophos built its own implant. The Kernel Implant — designed to silently retrieve logs and files dropped onto compromised firewalls — was deployed selectively to suspicious devices: firewalls registered to free webmail accounts on 163.com, checking in from Chinese IP ranges, or exhibiting other anomalies. This gave Sophos the ability to watch over the attackers' shoulders as they worked.

Phase Three: Targeted Espionage — Personal Panda, Covert Channels, and APT Attribution (2022–2023)

After the Cyberoam product line was exploited via a credential-creation vulnerability (later attributed to APT31 by France's ANSSI), the campaign shifted permanently to targeted attacks against specific organizations rather than mass exploitation.

▶ Watch: The Personal Panda Campaign (22:00)

In spring 2022, another pre-authentication RCE bug appeared via bug bounty — submitted from IP addresses tracing to China, though the submitter claimed to be in Japan. The following day, exploitation began. Brandt named this campaign Personal Panda because targeting seemed focused on countries within China's geopolitical sphere of influence. It involved two CVEs: one to break in, one to gain root via an OpenSSL vulnerability.

Among the most technically sophisticated payloads found during Personal Panda was a shared library named libsophos.so that performed machine-in-the-middle TLS decryption — effectively stripping HTTPS from web traffic to steal passwords. It included a bogus certificate authority certificate forged to appear signed by Fortinet (confirmed fake by Fortinet). The UK's National Cyber Security Centre analyzed this sample and named it Pygmy Goat. Sophos's implant traced the same file, binary-equal, to a firewall controlled by the attacker who called themselves "Tstark."

The Covert Channels attack family involved trojanized Java JARs delivered to firewalls. One payload — Termite — scraped credentials stored locally on the firewall and then attempted to access internal domain controllers via credential reuse. It marked the first time Sophos observed the attackers probing civilian infrastructure, including water and power utilities.

▶ Watch: Covert Channels and Critical Infrastructure Targeting (26:00)

Volexity's parallel investigation into a campaign called Drifting Cloud contributed a C2 IP address that led Sophos to a firewall running a Linux binary compiled from Bishop Fox's Sliver adversary emulation framework — an unusual choice when most attackers use Cobalt Strike. On one attacker-controlled bare-metal firewall, the threat actor also attempted to flash VectorEDK, a UEFI bootkit first documented by Kaspersky, though the attempt never succeeded.

The Unmasking: Guan Tianfeng and the $10M Bounty

Through OSINT and intelligence collaboration, Sophos ultimately identified the handle "gbigmao" — visible in early mailing list posts as someone who wanted to responsibly fix firewall vulnerabilities — as belonging to Guan Tianfeng, a 30-year-old employee of Sichuan Silence Information Technology Company in Chengdu. Chengdu appears repeatedly in the Pacific Rim investigation as a nexus of APT41 activity.

▶ Watch: The Attribution and Industry Implications (32:00)

Guan now carries a $10 million Rewards for Justice bounty from the U.S. government. He will never be able to leave China without risking arrest.

The Pacific Rim appendix, published alongside the October 2024 report, curated 206 serious firewall vulnerabilities through 2023. Of those, 44% — 92 CVEs — had CVSS scores of 9.8 or higher. At the time of Brandt's Black Hat talk, 130 new CVEs were being published per day, with an 80% year-over-year rise in known exploited vulnerabilities.

Notable Quotes

"The adversaries are using our own firewalls to conduct attacks. So let that sink in." — Andrew Brandt ▶ 30:04

"This was the first ransomware that I had ever seen that added Chinese to this safety measure." — Andrew Brandt ▶ 12:01

"None of us alone can fix everything. There's only one way to counter this threat — I think it's together." — Andrew Brandt ▶ 34:04

"This bright young man, once so idealistic, who wanted to fix firewalls — he'll never be able to leave China again without risking arrest. And I can't help but wonder, was it worth it?" — Andrew Brandt ▶ 32:04

Key Takeaways

• Bug bounty weaponization is a documented pattern. The Pacific Rim attackers submitted vulnerability details to Sophos's bug bounty program and then exploited the same bugs the next day — twice. Defenders should monitor for this timing correlation.
• Edge devices are intelligence goldmines. Firewalls, VPN gateways, and network appliances sit at the perfect position to intercept credentials, decrypt TLS, and proxy attacks. Treat them as high-value targets requiring the same hardening as domain controllers.
• Zombie firewalls are an active liability. Abandoned, unmonitored devices that still phone home to vendors create persistent footholds for threat actors. Decommissioning processes must include confirmed offline status.
• Vendor collaboration and transparency matter. Sophos's willingness to publish exhaustive technical detail — and to share intelligence with Volexity, Recorded Future, GCHQ's NCSC, France's ANSSI, and others — accelerated attribution and resulted in criminal charges. The industry needs structured information sharing to match the sophistication of state-level adversaries.
• Offensive counter-intelligence is a legitimate defensive tool. Sophos's deployment of its own kernel implant on suspected attacker-controlled firewalls gave unprecedented visibility into adversary techniques and tooling. The legal and ethical dimensions of this approach deserve industry discussion.

Slides

No slides PDF was listed for this talk. For Sophos's full Pacific Rim research, contact [email protected]. Additional reports referenced in the talk include the UK NCSC's Pygmy Goat analysis and Volexity's Drifting Cloud report.