Sophos X-Ops disclosed Operation Pacific Rim, detailing a five-year cyber-espionage campaign by Chinese state-sponsored clusters—overlapping Volt Typhoon, APT31, and APT41—targeting edge firewalls. Exploiting perimeter zero-days (including CVE-2020-12271 and CVE-2022-1040) alongside unpatched appliances, adversaries breached critical infrastructure, defense contractors, and nuclear energy entities across South and Southeast Asia. The actors systematically converted compromised network gateways into Operational Relay Boxes (ORBs) to obscure upstream espionage campaigns.

Post-exploitation analysis uncovered stealthy persistence tools, notably the “Pygmy Goat” ELF rootkit (libsophos.so). Injected into /bin/sshd via LD_PRELOAD, the rootkit hooked accept to sniff for magic-byte trigger packets, granting unauthenticated interactive shells without generating syslog entries. The backdoor communicated over raw ICMP sockets and TLS tunnels masquerading with forged certificates, facilitating reverse SOCKS proxies and experimental UEFI persistence. Sophos countered the intrusions by deploying live kernel hotpatches and memory telemetry to trace operator commands and sever adversary access.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Hooking daemon sockets via LD_PRELOAD operates below standard application-level monitoring, subverting audit logging and perimeter visibility while converting edge security devices into invisible proxy relays for downstream corporate network intrusions.
• Bullet 2 — Strategic & Defender Imperative: Security teams must treat edge gateways as high-risk, untrusted endpoints, aggressively deprecating end-of-life appliances, enforcing firmware integrity verification, and segregating management interfaces behind isolated, out-of-band administrative networks.