You are here

Home

Report – Sophos Unveils Evolving Tactics of China-based Cyber Threats to Critical Infrastructure

Report – Sophos Unveils Evolving Tactics of China-based Cyber Threats to Critical Infrastructure

Created: Tuesday, November 5, 2024 - 14:09
Categories:
Cybersecurity, Security Preparedness

Following a 5-year investigation into China-based cyber threats targeting critical infrastructure, Sophos researchers have attributed specific observed activity to Volt Typhoon, highlighting key behaviors in its Pacific Rim report. The report includes a summary of the adversary’s activity and key takeaways for defenders.

WaterISAC has shared extensively the threat posed by PRC-affiliated actors to the water sector (see below) and is including the takeaways from this report for member awareness and to help bolster the sector’s security. It is highly recommended that organizations work toward securing their edge devices, as these have been identified as one of the primary attack vectors used by these attackers. For more information, visit Sophos and Industrial Cyber.

Sophos includes three key evolving attacker behaviors:

  • A shift in focus from indiscriminate, noisy, and widespread attacks to stealthier operations against specific high-value and critical infrastructure targets.
  • Evolution in stealth and persistence capabilities with increased use of living-off-the-land and backdoor techniques.
  • Improved OPSEC or operational security tactics including sabotaging firewalls and hampering OSINT research by creating a reduced digital footprint.

Sophos’ key takeaways for defenders:

Edge network devices are high-value targets that well-resourced adversaries use for both initial access and persistence. Defenders' detection and response strategies need to take this into account. To aid defenders, Sophos has:

  • Provided TTPs and IOCs in the appendix of the detailed timeline to help defenders identify detection opportunities
  • Outlined the steps it takes to detect and respond to attacks against its customers’ firewalls

State-sponsored attackers use both zero-day and known vulnerabilities to attack edge devices. This targeting is not unique to Sophos firewalls; as evidenced by published CVEs, all edge devices are a target.

  • Closely follow your vendors device hardening guide (Sophos’ is here) to reduce attack surface and limit exploitability of zero-day vulnerabilities, paying particular attention to administrative interfaces
  • Enable hotfixes, if supported, and implement processes to monitor your vendors’ vulnerability disclosure communications — and quickly respond accordingly
  • Ensure you are running supported hardware and software for which your vendor is committed to releasing security updates

State-sponsored targeting is not limited to high-value espionage targets.

  • Threat actors use edge devices as operational relay boxes (ORBs) to attack onward targets and obfuscate the true origin of attacks
  • In a tightly connected digital ecosystem, many organizations form part of a critical infrastructure supply chain and may be targeted by actors seeking to disrupt critical services

WaterISAC’s prior analysis regarding PRC-affiliated actors, including Volt Typhoon: