174: Pacific Rim

This segment explores a sophisticated cyber attack that began with a compromised Linux-based computer in a sales office. The attackers successfully pivoted through the network to gain unauthorized access to a repository containing sensitive source code.

This segment details two major security incidents involving the cybersecurity company Sophos and its subsidiary, Cyberoam. It covers a 2014 breach of Cyberoam's source code and a 2020 vulnerability in the Sophos XG Firewall discovered via a bug bounty report.

A critical SQL injection vulnerability in Sophos firewalls allowed attackers to compromise 80,000 devices. The attackers used a malicious domain to push fraudulent updates, enabling them to steal system configurations and passwords.

The discussion centers on Sophos's decision to remotely deploy a hotfix to customer firewalls to mitigate an active security threat. Experts debate the balance between proactive security measures and the potential risks of vendors having unauthorized remote access to critical network infrastructure.

The podcast discusses a major security vulnerability in Sophos firewalls, which was linked to stolen source code from a previous acquisition, Cyberoam. Investigators suspect a sophisticated nation-state actor, possibly based in China, utilized virtualized instances of the software to develop and refine their cyberattacks.

Security researchers investigate a suspicious user named gbigmao, linking their activity to a Chinese security firm and specific firewall vulnerabilities. To better understand the threat actor's actions, the team develops a custom kernel implant to monitor the compromised devices.

Security researchers at Sophos discuss the ethical and operational implications of deploying a kernel implant to spy on threat actors using their firewalls in China. The conversation explores the technical capabilities of the implant and the broader industry context of firewall vulnerabilities.

Sophos responded to a sophisticated cyberattack by maintaining transparency and taking legal action to seize malicious domains. The company collaborated with international law enforcement, including Dutch authorities, to track down and analyze the threat actor's infrastructure.

This segment details the investigation into a sophisticated threat actor group that exploited firewall vulnerabilities, leading to the discovery of their infrastructure and naming conventions. The discussion highlights the role of telemetry and analytics in security, while noting the hackers' use of Norse mythology and Marvel-themed handles.

This segment details a high-stakes incident response operation involving Sophos firewalls and a series of sophisticated cyberattacks. The security team tracks the evolution of these attacks, codenaming them after Pacific Rim locations to manage the response to recurring vulnerabilities and web shell exploits.

Security researchers track a series of targeted cyberattacks against Sophos firewalls, eventually linking the activity to specific actors in China. By analyzing telemetry data and poor operational security practices by the attackers, the team identifies the individuals behind the exploits and discovers a pattern of malware development.

The segment details a sophisticated cyberattack campaign targeting Sophos firewalls, where threat actors utilized multiple zero-day vulnerabilities to monitor organizations supporting the Uyghur diaspora. Security researchers at Volexity and Sophos collaborated to uncover the extent of these exploits, which the hosts attribute to a well-resourced nation-state actor.

Andrew Brandt and Jack Rhysider discuss how the Sophos team utilized telemetry and implants to track multiple threat actors targeting their firewalls. By analyzing the behavior of these actors, they were able to attribute the attacks to Chinese defense contractors and develop proactive defense strategies.

The segment details a sophisticated, evolving cyberattack campaign targeting Sophos and Cyberoam firewalls. Security researchers discuss how threat actors leveraged stolen source code to exploit vulnerabilities and conduct highly targeted attacks against critical infrastructure in the APAC region.

This segment explores the sophisticated cyber attack campaign known as Pacific Rim, attributed to the Chinese state-sponsored group APT31. Security researchers discuss the challenges of defending against nation-state actors and the vulnerability of organizations, such as those supporting Tibetan exiles, when faced with advanced persistent threats.

The segment details an ongoing cyber conflict between Sophos and threat actors, specifically T-STARK and GBigMao, who exploited security patches to refine their attacks. As Sophos implemented stealthier defensive measures and telemetry, the attackers were forced to pivot toward developing advanced rootkits and UEFI bootkits to maintain persistence.

Security researchers discuss the discovery of dangerous UEFI bootkit malware targeting firewall firmware, which can render devices permanently unusable. The conversation highlights the efforts of Sophos to harden their systems and identifies a specific threat actor, Guan Tianfeng, who is linked to these activities.

Jack Rhysider discusses the ongoing cyberattacks against Sophos and other security vendors by a Chinese state-sponsored threat actor. Despite FBI intervention and the inclusion of the attacker on the Cyber's Most Wanted list, the frequency and scope of these attacks continue to escalate.