Sophos reveals how it battled a network of dangerous Chinese hackers for years

Sophos has revealed details about a five year battle with Chinese hackers targeting network devices around the globe.

The “Pacific RIm” reports outline groups of activities that cybersecurity vendors and law enforcement can attribute to known Volt Typhoon, APT31 and APT41/Winnti threat actors – with “varying degrees of confidence.”

Included in the target list were prominent manufacturers such as Fortinet, NetGearSophos, Check Point, Cisco and more. The attacks targeted high-value targets primarily in the Indo-Pacific region and included nuclear energy suppliers, telecommunications, military and government agencies.

Attacks on critical infrastructure

“For more than five years, Sophos has been investigating several groups in China targeting Sophos firewalls with botnets, new exploits and custom malware,” Sophos explains in the report.

State actors are not exclusively targeting high-value espionage targets, however, as Sophos observed that actors are using tightly connected digital ecosystems that are part of the critical infrastructure supply chain to disrupt critical services.

“This community is believed to be collaborating on vulnerability research and sharing its findings with both vendors and entities associated with the Chinese government, including contractors conducting offensive operations on behalf of the state. However, the full scope and nature of these activities have not been conclusively verified.” said Ross McKerchar, Sophos X-Ops.

Researchers believe the attacks began in 2018 when they hit the headquarters of Cyberoam, which is a Sophos subsidiary in India.

Critical infrastructure is increasingly at the receiving end of state-sponsored cyber attacks, with some estimates putting the figure at 420 million by 2023, representing 13 attacks per second.

One of the groups, Volt Typhoon, has already been found lurking on US critical infrastructure networks for years, so this news won’t come as much of a surprise. The state-sponsored group was positioned to steal sensitive information, monitor activity and disrupt infrastructure.

More from TechRadar Pro