Sophos remotely deployed hot fixes to affected firewalls to close the attack loopholes without requiring reboots.
Explicit Confidence 99% · Andrew Brandt EP 174 Details
“They pushed out a hot fix to these firewalls”
Organisation
organisation:sophos
Cybersecurity company whose firewall products were targeted and whose teams conducted the response.
Cybersecurity company whose firewall products were targeted and whose teams conducted the response.
“a principal researcher for Sophos”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | USES | Hot fix | Explicit | 174 |
| outgoing | DEVELOPED_BY | Sophos | Derived | 174 |
| outgoing | USES | sinkholing | Explicit | 174 |
| incoming | DEVELOPED_BY | Sophos | Derived | 174 |
| incoming | DEVELOPED_BY | Kernel implant | Explicit | 174 |
Sophos remotely deployed hot fixes to affected firewalls to close the attack loopholes without requiring reboots.
Explicit Confidence 99% · Andrew Brandt EP 174 Details
“They pushed out a hot fix to these firewalls”
Sophos developed an in-house kernel implant for covert telemetry and collection from selected threat-actor-controlled firewalls.
Derived Confidence 96% · Craig Jones EP 174 Details
“we developed a kernel implant in-house”
Kernel implant DEVELOPED_BY Sophos
The kernel implant was built by Sophos engineers and distributed only to selected machines of suspected threat actors.
Explicit Confidence 99% · Andrew Brandt EP 174 Details
“the security team decides they’re going to build something that they just call the implant”
Sophos USES sinkholing
Sophos used sinkholing after taking control of the malicious update domains to observe connecting systems.
Explicit Confidence 99% · Andrew Brandt EP 174 Details
“they wanted to sinkhole the domains and see what was connecting into them”