China's 5+ year campaign to penetrate perimeter network defenses

China's 5+ Year Campaign to Penetrate Perimeter Network Defenses

Speakers: Andrew Brandt

Conference: DEF CON 33

YouTube: https://www.youtube.com/watch?v=MsRo12h0mrg

Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Andrew%20Brandt%20-%20Firewall%20flameout%20Chinas%205%2B%20year%20campaign%20to%20penetrate%20perimeter%20network%20defenses.pdf

Overview

For more than five years, a collection of threat actors affiliated with the Chinese state systematically identified, weaponized, and exploited vulnerabilities in enterprise perimeter network devices — firewalls, VPN appliances, and network management systems — across thousands of organizations globally. At DEF CON 33, Andrew Brandt, who spent the duration of this research period at Sophos (and is now Principal Threat Researcher at Netcraft), delivered a detailed post-mortem of the campaign as investigated by the Sophos X-Ops team: how it started with an attempted attack on Sophos itself, how the company's offensive response evolved, what the threat actors' technical capabilities actually looked like, and what the broader industry needs to learn from it.

The talk is explicitly described by Brandt as "perhaps a little less technical than you might expect from a DEF CON talk" — it is as much a story of institutional decision-making, attribution methodology, and the challenges of threat intelligence sharing as it is an itemized list of CVEs. The research and linked reports are available via QR codes embedded in the original slides, and readers are encouraged to follow them for the complete technical details.

Background

▶ Watch: Speaker intro: Sophos X-Ops researcher and threat intelligence background (2:13)

The Target: Perimeter Network Devices

Enterprise firewalls, VPN concentrators, and UTM (Unified Threat Management) appliances sit at the edge of networks. They terminate encrypted tunnels from remote workers, enforce traffic policies, and — critically — run complex, often custom operating systems that are rarely subjected to the same scrutiny as general-purpose servers. Key properties that make them attractive targets:

• Privileged position: They see all ingress and egress traffic and are the first hop for many remote access paths.
• Persistent internet exposure: Unlike internal servers that might be behind additional layers of defense, perimeter devices must be reachable from the internet by design.
• Opaque software stacks: Many run custom embedded Linux or BSD variants with proprietary kernel patches, making third-party security analysis difficult.
• Long patch cycles: Enterprise network devices are often patched months or years behind schedule because upgrading them carries operational risk — a misconfigured firewall can take down the entire organization.
• Trusted by internal defenses: Once an attacker controls the firewall, they are often trusted by internal security controls (IDS, SIEM, endpoint agents) that treat traffic sourced from the firewall as legitimate.

Sophos X-Ops and the Research Context

Sophos X-Ops was the threat intelligence and research team that Brandt helped build. It sits at the intersection of malware research, EDR telemetry, MDR operations, and incident response — functioning as an internal threat intelligence fusion center. The unique position gave the team visibility across both Sophos product telemetry and incident response data from affected customers, enabling them to correlate the campaign's activity at scale.

The campaign that became the focus of this research started, remarkably, with an attack on Sophos's own headquarters network. The company made the decision to treat this as a research opportunity: rather than simply patching and moving on, they deployed an intelligence-collection operation to understand who was attacking them and why. This decision shaped everything that followed.

Key Findings

▶ Watch: Attribution clues: C2 infrastructure named after country TLDs (11:21)

1. A coordinated, multi-year Chinese state-nexus campaign targeted perimeter network devices — particularly Sophos XG firewalls — across thousands of organizations worldwide over more than five years.

1. The attackers demonstrated a tiered capability development cycle: From initial exploitation of a zero-day in Sophos's firewall, through deployment of progressively sophisticated malware families, to eventually using novel UEFI implants and living-off-the-land techniques that indicated significant R&D investment.

1. Multiple distinct threat actor clusters were involved, sharing tooling and infrastructure but operating with different targeting priorities — some focused on government and defense, others on critical infrastructure, others on what appeared to be bulk opportunistic access.

1. Sophos's response included deploying targeted telemetry into the devices of specific threat actor infrastructure under controlled conditions — effectively conducting a counter-intelligence operation that illuminated the attackers' toolchain and methodologies.

1. A pattern of discovery and adaptation: Each time Sophos publicly disclosed a vulnerability and published indicators of compromise, the threat actors modified their malware and pivoted to new techniques — demonstrating active operational security monitoring of Sophos's threat intelligence output.

1. Attribution was eventually made public: Sophos and U.S. government partners attributed elements of the campaign to Sichuan Silence and APT group affiliates associated with the Chinese Ministry of State Security (MSS).

Technical Deep Dive

▶ Watch: Escalation: attackers target EOL Cyberoam devices for pivot (18:02)

The Initial Intrusion: Attack on Sophos HQ

The campaign that Sophos investigated began with an attack on a device in their own Cyberoam testing lab. The attackers exploited a vulnerability in the Cyberoam UTM appliance (a product Sophos had acquired) to establish a foothold within a segment of the company's network.

Rather than immediately remediating and closing the incident, Sophos made the strategic decision to instrument the compromised environment and observe the attackers. This gave the team their first detailed look at the attackers' TTPs, malware, and — crucially — their development infrastructure.

Zero-Day Exploitation of Sophos XG

The first major public event in the campaign was the discovery in April 2020 of a zero-day SQL injection vulnerability (later assigned CVE-2020-12271) in the Sophos XG firewall's administrative interface. The vulnerability was exploited at scale before Sophos had any knowledge of it. The attackers:

1. Sent crafted SQL injection payloads to the device management portal.
2. Gained remote code execution on the firewall operating system.
3. Deployed a multi-stage malware chain dubbed Asnarök — including a kernel module (rootkit) that intercepted and modified the device's own update mechanism to ensure persistence across legitimate patches.
4. Used the compromised firewalls as pivot points to reach internal network segments.

The Asnarök chain was notable for its specificity: it targeted the Sophos XG's custom Linux-based OS, indicating the attackers had done significant preparatory research on the target platform's internals.

Malware Evolution: The Attacker's Development Cycle

Over the five-year span of research, Sophos documented a progression of malware families deployed by the threat actor cluster(s):

• Asnarök (2020): SQL injection + multi-stage loader + kernel rootkit targeting XG firmware.
• Fica and Samurai (2021–2022): More sophisticated implants with encrypted C2 channels, deployed on XG devices that had been re-compromised after patches.
• Pygmy Goat (2023): A novel UEFI-level implant that persisted across complete firmware reinstallation — the most sophisticated artifact in the campaign. Sophos worked with NCSC-UK on this disclosure.
• Living-off-the-land techniques: Later stages showed attackers using the firewall's own legitimate administrative APIs and scripting capabilities to execute commands, reducing their malware footprint.

The progression demonstrates a threat actor with significant R&D capacity, not simply an opportunistic buyer of off-the-shelf exploits.

Counter-Intelligence and Telemetry Operations

One of the most operationally unusual elements of the Sophos response was the decision to deploy targeted "surveillance" capability onto compromised devices belonging to specific threat actor infrastructure. With appropriate legal approvals, the team pushed telemetry agents to selected attacker-controlled Sophos devices and observed:

• The attackers' development environment (file paths, tool names, compilation timestamps).
• Evidence that the same team was actively monitoring Sophos's public threat intelligence publications and adapting their malware in response.
• Infrastructure overlap connecting multiple attack clusters to shared resources, supporting the attribution case.

Brandt was careful to note that this activity was conducted within a strict legal and ethical framework — it was targeted at attacker infrastructure, not innocent third parties — but acknowledged that it represented an unusual and controversial choice for a commercial security vendor.

Scope and Attribution

The campaign affected organizations across:

• Government and defense sectors
• Critical infrastructure (energy, water, healthcare)
• Financial services
• Technology companies

Geographic distribution was global, with significant clusters in the Indo-Pacific region consistent with Chinese strategic intelligence collection priorities.

Attribution involved correlating:

• Infrastructure overlap with known Chinese APT groups.
• Malware code similarities to previously attributed tooling.
• Targeting patterns consistent with MSS collection priorities.
• Eventually, direct collaboration with U.S. government partners who had independent attribution evidence.

The public attribution to Sichuan Silence (a PRC contractor linked to MSS) was part of a coordinated disclosure that included U.S. Treasury sanctions — an unusual escalation that Brandt discussed as a sign of how seriously the government treated the campaign.

Demo / Proof of Concept

▶ Watch: Persistence technique: attacker-controlled firewall accounts via free webmail (20:20)

This talk did not include a technical live demo. Instead, Brandt used QR codes throughout the presentation linking to Sophos's published research reports, which contain the full technical details: YARA rules, IOCs, network indicators, malware family descriptions, and timeline documentation. These public resources serve as the technical supplement to the narrative talk.

Key linked reports (accessible via Sophos's threat research blog and the Pacific Rim disclosure) cover:

• The initial Asnarök disclosure (2020)
• The Pygmy Goat UEFI implant analysis (2023)
• The Pacific Rim campaign overview and attribution documentation

Defensive Implications

▶ Watch: Attribution breakthrough: firewall linked to specific Chinese threat actor (25:59)

Patch Perimeter Devices Fast and Often

The core operational lesson from the campaign: perimeter network devices need the same (or faster) patch cadence as internet-facing servers. Treating firewall upgrades as high-risk, long-lead-time events while a zero-day remains unpatched for weeks is an untenable risk posture against motivated state-level adversaries.

Assume Compromise of Perimeter Devices

Brandt recommended treating perimeter devices as potentially compromised and designing internal networks accordingly:

• Zero-trust segmentation: Do not allow the firewall to be trusted implicitly by internal hosts. Enforce authentication and authorization at the application layer regardless of source IP.
• Out-of-band management: Manage network devices through a dedicated, isolated management network rather than in-band channels that could be controlled by an attacker on the firewall.
• Integrity verification: Periodically verify firmware integrity against known-good hashes. Some vendors provide signed firmware manifests.

Vendor Transparency and Incident Disclosure

A recurring theme of the talk was Sophos's choice to go public with information about their own compromise and to publish detailed threat intelligence rather than suppress it:

• Defenders across the industry benefit from detailed IOCs and TTPs.
• Threat actors who know their tools are publicly documented face additional operational costs.
• Vendors who disclose their own vulnerabilities and compromises build more credibility than those who minimize or conceal incidents.

Monitor EDR-Dark Devices

Perimeter network devices typically do not support EDR agents — the firewall is "EDR-dark." Defenders need compensating controls: network traffic baselining, anomaly detection on management interface connections, and regular integrity checks of device configuration and firmware.

Key Takeaways

• Chinese state-affiliated threat actors conducted a coordinated, multi-year campaign against perimeter network devices that evolved significantly in sophistication over the five-year observation period.
• The campaign started with a zero-day SQL injection against Sophos's own infrastructure and grew to include UEFI-persistent implants demonstrating state-level R&D investment.
• Perimeter devices are high-value targets: they are internet-exposed, trusted by internal defenses, rarely patched quickly, and opaque to standard endpoint security tooling.
• Sophos's decision to conduct counter-intelligence operations against attacker infrastructure — with legal approvals — yielded attribution evidence and is a controversial but instructive model for vendor response to state-level attacks.
• The attackers monitored Sophos's threat intelligence and adapted their tooling in response — indicating that disclosure of IOCs has a time-limited protective effect and must be combined with rapid patching.
• Coordinated attribution and government action (Treasury sanctions against Sichuan Silence) followed years of evidence collection, illustrating the long timeline between discovery and consequences in nation-state attribution.

About the Speaker

Andrew Brandt is Principal Threat Researcher at Netcraft. During the research period covered by this talk, he was at Sophos, where he was the first member of the X-Ops team — a cross-functional threat intelligence and research group bridging malware research, EDR, MDR, IR, and security operations. He also contributes to tech policy work, runs Electorate Hackers (an organization that recruits and trains candidates for elected office from the hacker community), and maintains retrocomputing hardware at the Media Archaeology Lab at the University of Colorado Boulder. He also assists with Malware Village at DEF CON.