China's 5+ Year Campaign to Penetrate Perimeter Network Defenses

## Overview

In the presentation "Firewalls Under Fire," Andrew Brandt details a multi-year campaign dubbed **Pacific Rim**, conducted by Chinese threat actors targeting edge network devices—specifically Sophos XG firewalls and related infrastructure. The research, spearheaded by Sophos’s threat intelligence fusion group X-Ops, traces adversary activity across three distinct phases: 1. **Initial Intrusion (2018):** Direct compromise of Sophos's internal corporate assets. 2. **Mass Exploitation Era (Starting 2020):** Widespread, public zero-day campaigns against Internet-facing firewalls worldwide. 3. **Targeted Espionage:** Selective operations focused on specific, high-value entities primarily in the Asia-Pacific region.

Brandt notes that the threat ecosystem involved several individuals, commercial entities, and a university based in Chengdu (Sichuan Province, China), with edge device exploitation persisting across major vendors.

---

## Phase 1: Internal Compromise and "Cloud Snooper" (2018)

The campaign surfaced following Sophos’s acquisition of Cyberoam (the Indian company whose platform formed the foundation of SFOS, the OS powering Sophos XG firewalls).

* **Initial Discovery:** Sophos SecOps detected unauthorized internal scanning originating from a small computer affixed to a sales bullpen TV monitor displaying leaderboard metrics. * **Malware and Tooling:** The device contained utilities such as Ghost RAT and maintained connections to a cloud server used by the Cyberoam team to store sensitive information. Investigators uncovered at least 11 pieces of malware across the systems, including a Windows DLL inexplicably placed in an all-Linux environment. * **Deep Packet Inspection Rootkit ("Snoopy"):** Attackers installed an AWS cloud rootkit containing an engine named "Snoopy." The tool bypassed Web Application Firewalls (WAF) by monitoring inbound TCP source ports—normally ephemeral values—which acted as encoded commands. Crafted inbound packets exfiltrated stolen data back over the same established TCP connection. * **Attribution Artifacts:** Snoopy outputted debug messages in Chinese, derived its C2 encryption key from a hash of the literal phrase `"replace with your password"`, and contacted C2 domains referencing the country code top-level domain for Nepal.

---

## Phase 2: Mass Exploitation and Counter-Surveillance

In 2020, adversary activity shifted from stealthy reconnaissance to global opportunistic campaigns.

### The "Aznarok" Attack * **Vector and Execution:** Prompted by a customer screenshot revealing arbitrary Linux commands injected into the XG firewall management interface, Sophos uncovered a SQL injection zero-day executing arbitrary remote code. The exploit dropped a helper script and an info-stealing payload named `to own` that stored configuration data in `info.xg`, encrypted using the password `"Gucci"`. * **Bug Bounty Timing:** The exact attack methodology was submitted to Sophos’s bug bounty program only one day prior to the mass campaign, indicating a race to monetize before exploitation. * **Ragnarok Ransomware & Dead Man’s Switch:** Attackers monitored an empty canary file; if removed (e.g., via automated vendor hotfixes), a secondary routine was triggered to fetch ransomware from `Ragnarok from Asgard`. Targeting LAN-side endpoints using EternalBlue and DoublePulsar, the executable (`HotFix`) uniquely checked system localization to avoid running on machines configured for either Russian or Chinese.

### Active Countermeasures: "The Implant" Following Dutch authorities' seizure of the attacker-controlled hosting server in the Netherlands, Sophos sinkholed the command domains. SecOps then deployed a custom, stealthy kernel-level implant to specific suspicious firewalls (e.g., those registered via `163.com` email addresses and originating from Central Chinese IP ranges). This allowed Sophos to monitor threat actor test environments, inspect exploit development before launch, and deploy global patches before zero-days went live.

---

## Evolution: The "Baja" Campaign and Infrastructure Abuse

During summer 2020, the attackers launched the "Baja" campaign, targeting a bookmark feature buffer overflow.

* **Refined Capabilities:** Attackers reverse-engineered prior hotfixes, implemented evasion mechanisms, and added capabilities to wipe entire system logs or selectively delete individual lines. * **Development Clusters:** Threat telemetry exposed entire clusters of virtual and bare-metal XG firewalls configured without internal local area networks (LANs). These devices functioned exclusively as exploit staging platforms and development testbeds, heavily registered under non-corporate email accounts (notably accounts prefixed with `G big mau`).