Pacific Rim Campaign INVOLVES Asnarok
Asnarok was one of the incidents in the broader Pacific Rim Campaign.
Explicit Confidence 99% · Jack Rhysider EP 174 Details
“they called this whole series of incidents the Pacific Rim Campaign”
Campaign
campaign:pacific_rim_campaign
Also: Pacific Rim
Name Sophos used for the series of linked attack campaigns against its firewall products.
Name Sophos used for the series of linked attack campaigns against its firewall products.
“they called this whole series of incidents the Pacific Rim Campaign”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | INVOLVES | Asnarok | Explicit | 174 |
| outgoing | INVOLVES | Baja | Explicit | 174 |
| outgoing | ATTRIBUTED_TO | Chinese state-sponsored threat actor | Attributed | 174 |
| outgoing | TARGETS | China | Explicit | 174 |
Pacific Rim Campaign INVOLVES Asnarok
Asnarok was one of the incidents in the broader Pacific Rim Campaign.
Explicit Confidence 99% · Jack Rhysider EP 174 Details
“they called this whole series of incidents the Pacific Rim Campaign”
Pacific Rim Campaign INVOLVES Baja
Baja was another named attack in the Pacific Rim Campaign.
Explicit Confidence 99% · Andrew Brandt EP 174 Details
“they give this attack a nickname, Baja”
Pacific Rim Campaign ATTRIBUTED_TO Chinese state-sponsored threat actor
The episode attributes the Pacific Rim attack campaign to a Chinese state-sponsored threat actor; Jack presents this as the conclusion after the reported attribution to ABT31.
Attributed Confidence 97% · Jack Rhysider EP 174 Details
“the attack was carried out by ABT31, just a Chinese state-sponsored hacker group”
Pacific Rim Campaign TARGETS China
The episode repeatedly describes the actors and their research infrastructure as being located in China, especially Chengdu; this is not a claim that China itself was the victim target.
Explicit Confidence 86% · Craig Jones EP 174 Details
“we found these multiple companies. One of the simplest ways we actually found it, funnily enough — and this sounds so basic — is that we would look at devices that would be continually going up and down firmware versions. These threat actor devices would constantly put the new, latest firmware on, roll it back, new firmware, roll it back. They’d do this, I don’t know, maybe five or six times a day. Whereas normal firewall operation, it’s like, it’s a new firmware and it’s left. Then in a month it gets new firmware and then it’s left. So, these things just stood out like a sore thumb. So, some of it came really easy to find these threat actors. The more telemetry we had the easier it got. We started to really build a wide assortment of threat actors in China”