Pacific Rim: Sophos Researchers Recount Years of Firewall Exploits and Countermeasures
· 1:30:55 · Watch on YouTube ↗
Summary
Former Sophos researchers describe Pacific Rim, a years-long series of firewall attacks linked to Chinese operators, and how hot fixes, sinkholing and covert telemetry helped counter exploits. An experimental UEFI bootkit failed.
Key points
- Attackers accessed Cyberoam’s source-code repository in 2018; investigators suspected code theft but initially lacked sufficient monitoring to confirm what was taken.
- In 2020, attackers exploited SQL injection in internet-facing Sophos XG Firewalls. Craig Jones cites an FBI report describing roughly 80,000 affected devices.
- Attackers sought firewall configurations and passwords and directed devices to malicious update domains. Sophos deployed hot fixes, seized the domains and worked with Dutch authorities to analyze a seized C2 server.
- Sophos researchers say they deployed a covert kernel implant only to devices they identified as attacker-owned, unlicensed systems in China, allowing them to recover exploit-development files.
- Later attacks used web shells, disabled hot fixes and telemetry, and increasingly targeted Asia-Pacific organizations, including charities supporting Uyghur and Tibetan communities.
- Researchers recovered custom rootkits and observed unsuccessful UEFI bootkit development that bricked a test firewall. Sophos subsequently changed low-level firmware to block that approach.
- Andrew Brandt identifies gbigmau as Guan Tianfeng and cites an FBI accusation concerning 80,000 firewall compromises. He says the published account ends in 2024, but the attacks continued.
Article Details
- Topics
- [01:13] Initial Cyberoam intrusion and access to the source-code repository
- [06:48] Discovery of widespread Sophos XG Firewall SQL injection exploitation
- [14:07] Emergency hot fixes and the risks of vendor-controlled updates
- [23:10] Telemetry-based attribution and covert monitoring of attacker development systems
- [37:32] Malicious update-domain seizures, sinkholing and Dutch C2 investigation
- [47:30] Baja attacks, web shells and targeting of diaspora-support organizations
- [01:07:45] Targeted espionage and accelerated retirement of Cyberoam firewalls
- [01:13:11] Custom rootkits, failed UEFI bootkit development and continuing attacks
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | sophosfirewallupdate[.]com | Attacker-operated domain used by compromised firewalls to retrieve purported updates; subsequently seized and sinkholed by Sophos. |
| DOMAIN | sophosproductupdate[.]com | Malicious update domain used in the firewall attacks; subsequently seized for sinkholing. |
MITRE ATT&CK
T1014 · RootkitResearchers recovered custom rootkits used to hide attacker presence on compromised firewalls.T1070.002 · Clear Linux or Mac System LogsBrandt describes the libsophos rootkit deleting logs on the Linux-based firewalls.T1190 · Exploit Public-Facing ApplicationAttackers exploited internet-facing firewall web interfaces, including SQL injection vulnerabilities, to obtain access.T1505.003 · Web ShellThe Baja attacks installed web shells on firewalls for direct remote access.T1562.001 · Disable or Modify ToolsAttackers disabled firewall hot-fix functionality and telemetry to obstruct remediation and detection.T1587.001 · MalwareResearchers observed attacker development and testing of custom malware, including rootkits and an unsuccessful UEFI bootkit.
People
Andrew BrandtFormer principal researcher at Sophos who investigated and published accounts of the firewall attacks; interviewed as a principal threat researcher at Netcraft.Craig JonesFormer senior director of information security at Sophos who helped respond to the Cyberoam intrusion and subsequent firewall attacks; interviewed as chief security officer of Ontinue.
Threat Actors
ABT31The transcript states that French authorities publicly attributed the Cyberoam intrusion to this Chinese state-sponsored group; the name is preserved as transcribed.gbigmauHandle researchers associated with firewall exploit testing and development through trial-license telemetry. Brandt explicitly identifies this operator as Guan Tianfeng and cites an FBI accusation involving 80,000 Sophos firewall compromises.Guan TianfengIdentified by Brandt as the operator using the handle gbigmau. The transcript attributes to an FBI wanted poster the accusation that he compromised 80,000 Sophos firewalls.TStarkOperator researchers linked to exploit and malware development on trial firewalls, including payloads subsequently found on customer devices and development of a custom rootkit.
Malware
Vendors
Products
Tools
Countries
China[09:13] come from a web trial of a VN. We find the IP actually related back to Chengdu in China.Netherlands[38:53] CRAIG: [Music] The server used by the threat actor actually sat in the Netherlands, and itPakistan[51:56] type attack. This was specific devices around the Asia Pacific area like Taiwan, Pakistan,Philippines[52:06] places like Philippines, very much target, completely different to the first attack. WeTaiwan[51:56] type attack. This was specific devices around the Asia Pacific area like Taiwan, Pakistan,
Industries
Critical infrastructure[59:55] want to say they're critical infrastructure, but they're protecting critical infrastructure.fine arts[01:08:08] kinda retail through to military, even fine arts. Again, all focused in the APAC region.Government[57:55] about surveillance of these two groups of people, and that is the government of China.Healthcare[01:08:04] research and development organizations, healthcare providers, everything fromMilitary[01:08:08] kinda retail through to military, even fine arts. Again, all focused in the APAC region.Research and development[01:08:04] research and development organizations, healthcare providers, everything fromRetail[01:08:08] kinda retail through to military, even fine arts. Again, all focused in the APAC region.