Incident
incident:cyberoam_intrusion
Also: 2018 Cyberoam attack
Earlier intrusion into Cyberoam in which attackers accessed the repository containing firewall source code.
Earlier intrusion into Cyberoam in which attackers accessed the repository containing firewall source code.
“there was an attack on Cyberoam”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | COMPROMISES | Cyberoam | Explicit | 174 |
| outgoing | INVOLVES | Intel NUC | Explicit | 174 |
| outgoing | INVOLVES | Linux | Explicit | 174 |
| outgoing | ATTRIBUTED_TO | Chinese state-sponsored threat actor | Uncertain | 174 |
Cyberoam intrusion COMPROMISES Cyberoam
The 2018 intrusion compromised Cyberoam's network and enabled attackers to reach systems containing firewall source code.
Explicit Confidence 98% · Jack Rhysider EP 174 Details
“Someone had gotten into Cyberoam and was looking for their source code”
Cyberoam intrusion INVOLVES Intel NUC
The intrusion began with an infected Intel NUC used to drive a sales-office display.
Explicit Confidence 97% · Andrew Brandt EP 174 Details
“that was the first machine that got infected”
Cyberoam intrusion INVOLVES Linux
The initially infected Intel NUC was running Linux.
Explicit Confidence 98% · Andrew Brandt EP 174 Details
“a little Linux computer, and that was the first machine that got infected”
Cyberoam intrusion ATTRIBUTED_TO Chinese state-sponsored threat actor
The episode connects the earlier Cyberoam source-code theft to the later Chinese state-sponsored Pacific Rim activity, but the connection is presented as an investigative conclusion rather than direct proof in the episode.
Uncertain Confidence 82% · Jack Rhysider EP 174 Details
“This is starting to smell like a nation-state actor is behind this”