DEF CON 33 - China's 5+ year campaign to penetrate perimeter network defenses - Andrew Brandt

This presentation reveals a five-year campaign of coordinated attacks targeting firewalls to breach protected networks, with Chinese threat actors exploiting vulnerabilities across multiple phases of attacks 0:17.

Key Takeaways:
• The campaign named "Pacific Rim" involved three phases: initial intrusion in 2018, public mass attacks in 2020, and targeted attacks against specific organizations thereafter 2:43
• Attackers demonstrated sophisticated techniques including rootkits, custom malware, and even repurposed firewalls as operational relay beacons to disguise attack origins 5:30
• Key attacks included "Asnarok" which exploited a SQL injection vulnerability and deployed ransomware called Ragnarok, complete with a "dead man switch" mechanism 9:54
• Sophos responded with "radical transparency," publishing detailed reports and creating an "implant" tool to monitor attacker activity and gather intelligence 3:42
• Threat actors were linked to Chengdu, China, with connections to known APT groups and targeting of organizations supporting oppressed minorities 19:23

These attacks continue today against every major firewall vendor, with vulnerabilities increasing at an alarming rate 30:34.

Sources:

• 0:17 Introduction to the five-year firewall attack campaign
• 2:43 Three phases of the Pacific Rim attack campaign
• 5:30 Cloud snooper attack with rootkit and packet inspection
• 9:54 Asna