US Indicts, Sanctions Alleged Chinese Sophos Firewall Hacker

The U.S. federal government rolled out its heavy guns Tuesday against a Chinese hacker allegedly at the center of a zero-day exploit used to hack firewalls made by Sophos, unsealing an indictment, rolling out sanctions and offering $10 million for information leading to the suspect’s arrest.

See Also: Corelight’s Brian Dye on NDR’s Role in Defeating Ransomware

The government typically reserves its three-bore weapon of criminal charges, sanctions and life-changing reward money for nation-state hackers unlikely to ever see the inside of an American courtroom (see: US Pressures Iran Over Phishing Campaign Against Feds).

Tuesday’s recipient of the full court press was Tianfeng Guan, a Chinese national who prosecutors say was an employee in 2020 of Sichuan Silence Information Technology, a private sector contactor for Beijing intelligence agencies. The Department of Treasury banished Guan and Sichuan Silence from the U.S. financial system while the Department of State pledged $10 million for information on Guan and his work colleagues.

“The Department of Justice will hold accountable those who contribute to the dangerous ecosystem of China-based enabling companies that carry out indiscriminate hacks on behalf of their sponsors and undermine global cybersecurity,” asserted Assistant Attorney General for National Security Matthew G. Olsen.

In a two-count indictment, prosecutors say Guan and his coworkers identified a zero-day later tracked as CVE-2020-12271. They developed an SQL injection vulnerability used against instances of Sophos’ XG firewall in a campaign affecting about 81,000 machines, of which more than a quarter were located in the United States, including dozens located in the networks of critical infrastructure operators.

Guan and company at first used the zero-day flaw to plant the Asnarök Trojan, but switched to a ransomware attack using Ragnarök malware after Sophos hurried out a patch. Patched firewalls were protected against the ransomware (see: Hackers Tried to Exploit Zero-Day Flaw in Sophos Firewall).

Sophos in October disclosed a half-decade worth of efforts by multiple nation-state Chinese hacking groups to infiltrate its appliances, including the Sichuan Silence Information Technology firewall campaign (see: Sophos Discloses Half Decade of Sustained Chinese Attack).

After the Sophos disclosure of its counteroffensive against Chinese hackers, a fight the private equity-owned company called “Pacific Rim,” the FBI called for public assistance in an investigation “involving the compromise of edge devices and computer networks belonging to companies and government entities.” Sophos CISO Ross McKerchar in an emailed statement said the company applauds today’s actions. “We can’t expect these groups to slow down, if we don’t put the time and effort into out-innovating them, and this includes early transparency about vulnerabilities and a commitment to develop stronger software,” he said.

Among the evidence linking Guan and Sichuan Silence to the spring 2020 compromises of Sophos XG firewalls were command and control online domains used to host malware. They used sophosfirewallupdate.com to deploy the Trojan and 9sg.met for a loader leading to Ragnarök ransomware. The IP addresses of both domains resolved to China, prosecutors said.

The indictment offers a timeline of Guan’s progress, stating that he registered a test Sophos device on Feb. 14, 2020, a second test device on Feb. 16, 2020 – the same day that he also allegedly pointed a web browser to the Sophos website to read about firewall vulnerabilities. The hacking campaign began on or about April 22, 2020, the indictment states.

The Treasury Department posted Tuesday that Guan competed on behalf of Sichuan Silence in cybersecurity tournaments, underscoring China’s well-developed pipeline for developing hacking talent. Sichuan Silence is located in Chengdu, a western Chinese city that’s emerged as a magnet for a burgeoning hacking industry supported by Chinese intelligence agencies. “Silicon Valley is good for tech. Shenzhen’s good for hardware, and Chengdu is good if you want to be a vulnerability researcher,” McKerchar told Information Security Media Group in October.