China's 5+ Year Campaign to Penetrate Perimeter Network Defenses
Sophos researcher Andrew Brandt chronicles a five-year investigation into Chinese nation-state campaigns weaponizing zero-days against perimeter firewall appliances.
Summary
Nation-State Targeting of Perimeter Security Appliances
Chinese Advanced Persistent Threat (APT) groups have systematically targeted internet-exposed perimeter firewalls, VPN gateways, and edge routers to establish persistent footholds into enterprise networks.
Weaponizing Zero-Day Exploits Against Security Hardware
Andrew Brandt details the discovery and analysis of multiple zero-day remote code execution vulnerabilities exploited by state-sponsored actors against Sophos firewalls and enterprise gateway devices.
Sophisticated In-Memory Implants and Rootkits
Adversaries deployed bespoke Linux kernel rootkits and in-memory backdoors engineered to evade firmware integrity checks, disable logging, and survive device reboots.
Defensive Telemetry and Global Incident Response
Uncovering multi-year nation-state operations highlights the critical need for rapid automated hotpatching, continuous firmware threat hunting, and moving beyond perimeter-only defense models.
Related talks
Main Stage·34 min
Michael Torres · Zane Hoffman
Provides an inside look at a massive operational relay network (ORB) of compromised IoT devices and routers used by Chinese APT actors to obfuscate cyber attacks.
Adversary Village·45 min
Cheryl Biswas
Cheryl Biswas analyzes decades of Chinese state-sponsored supply chain intrusions and economic espionage campaigns across global technology sectors.
Main Stage·36 min
C Tafani-Dereeper · M Muir
Examines campaigns by nation-state actors (such as Iranian and DPRK groups) targeting cybersecurity researchers and think tanks via social engineering.