Black Hat USA 2025 | China's 5+ Year Campaign to Penetrate Perimeter Network Defenses

Why It Matters

The findings underscore that perimeter firewalls are no longer a reliable last line of defense, compelling organizations to adopt proactive patching and shared intelligence to defend against sophisticated, state-backed intrusion campaigns.

Key Takeaways

• Chinese actors launched multi-year firewall exploitation campaign targeting global networks
• Sophos identified three attack phases: initial breach, public exploits, stealth targeting
• "Cloud Snooper" used packet-level rootkits to exfiltrate data via firewalls
• "Aznarok" leveraged pre-bounty SQL injection and custom ransomware "Ragnarok"
• Ongoing attacks force vendors to accelerate hot-fix deployment and threat-intel sharing

Summary

The Black Hat talk detailed a multi-year, state-linked campaign by Chinese threat actors aimed at compromising perimeter firewalls and the networks they protect. Presenter Andrew Brandt, a principal threat researcher formerly at Sophos, walked through the evolution of the operation, which Sophos labeled “Pacific Rim” and traced back to 2018.

Research uncovered three distinct phases: an initial intrusion of Sophos’s own environment in 2018, a wave of public exploits beginning in 2020 (notably the “Aznarok” attack that leveraged a pre‑bounty SQL injection), and a later, low‑profile phase targeting specific customers with bespoke payloads. The attackers employed custom rootkits such as “Cloud Snooper,” packet‑inspection engines that read source‑port values as commands, and deployed ransomware dubbed “Ragnarok” that incorporated Chinese‑language safety checks.

Brandt highlighted vivid details: a compromised TV‑monitor device in a sales bullpen, debug messages in Chinese, a dead‑man‑switch file that triggered a secondary URL, and the use of domains like “firewallupdate.com” registered moments before exploitation. Sophos responded by publishing five technical reports, sink‑holing malicious domains, and inserting a stealth implant to monitor compromised firewalls in real time.

The campaign demonstrates that even mature firewall products remain attractive targets and that threat actors can sustain long‑term footholds through continuous vulnerability discovery and custom tooling. Enterprises must prioritize rapid hot‑fix deployment, continuous telemetry monitoring, and collaborative threat‑intel sharing to mitigate similar nation‑state‑level incursions.

Original Description

For more than five years, firewall vendors have been under a persistent, cyclical struggle against a well-resourced and relentless China-based adversary that has expended considerable resources developing custom exploits and bespoke malware expressly for the purpose of compromising enterprise firewalls in customer environments. In this first-of-its-kind presentation, I will walk attendees through the complete history of the campaign, detailing the full scope of attacks and the countermeasures one firewall vendor developed to derail the threat actors. The presentation will provide rich detail into the exploit development targeting specific firewalls, how the exploits were deployed and leveraged to compromise customers, and characteristics of the malware deployed inside the firewall's operating system as a result of these attacks.

Fundamental to this presentation is the fact that the adversary behind this campaign has not targeted only one firewall vendor: Most of the large network security providers in the industry have been targeted multiple times, using many of the same tactics and tools. So this serves not merely as a warning to the entire security industry, but as an urgent call to the companies that make up this industry to collectively combat this ongoing problem. Because at the end of the day, we all face the same threat, and we cannot hope to withstand the tempo and volume of these attacks alone. We must work together.

By:

Andrew Brandt | Hacker

Presentation Materials Available at:

https://blackhat.com/us-25/briefings/schedule/?#firewalls-under-fire-chinas-5-year-campaign-to-penetrate-perimeter-network-defenses-46097