Episode
05 May 2026 Official episode · Official transcript
advanced persistent threat research incident response botnet
The episode examines a long-running campaign targeting Sophos and other firewall vendors, including the Asnarok and Baja attacks, exploitation of multiple zero-days, covert telemetry and kernel implants, and attribution to Chinese state-linked actors.
Topics: SQL injection in a firewall web interface, Exploitation of zero-day vulnerabilities, Malicious software-update redirection, Remote hot fixes and vendor-controlled patching, Kernel implants and covert vendor telemetry, Threat-actor infrastructure and command-and-control servers, Domain seizure and sinkholing, Web shells and direct firewall access, Local privilege escalation, Rootkits and persistence, UEFI bootkits, Threat hunting across firewall telemetry, OSINT-based threat-actor attribution, Firmware rollback and exploit testing, Targeted attacks against APAC organizations, Chinese state-sponsored cyber operations
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
Cyberoam intrusion COMPROMISES Cyberoam
The 2018 intrusion compromised Cyberoam's network and enabled attackers to reach systems containing firewall source code.
Explicit Confidence 98% · Jack Rhysider EP 174 Details
“Someone had gotten into Cyberoam and was looking for their source code”
Cyberoam intrusion INVOLVES Intel NUC
The intrusion began with an infected Intel NUC used to drive a sales-office display.
Explicit Confidence 97% · Andrew Brandt EP 174 Details
“that was the first machine that got infected”
Cyberoam intrusion INVOLVES Linux
The initially infected Intel NUC was running Linux.
Explicit Confidence 98% · Andrew Brandt EP 174 Details
“a little Linux computer, and that was the first machine that got infected”
Sophos XG Firewall DEVELOPED_BY Cyberoam
The Cyberoam product became the predecessor/code base for the Sophos XG Firewall.
Explicit Confidence 99% · Andrew Brandt EP 174 Details
“the Cyberoam code is the predecessor to the XG Firewall code”
Asnarok EXPLOITS SQL injection
Asnarok exploited a SQL injection vulnerability in the Sophos XG Firewall web interface.
Explicit Confidence 99% · Jack Rhysider EP 174 Details
“the web UI of this firewall had a SQL injection vulnerability in it”
Asnarok AFFECTS Sophos XG Firewall
The Asnarok exploit affected the Sophos XG Firewall.
Explicit Confidence 96% · Andrew Brandt EP 174 Details
“Sophos has a firewall called the XG Firewall”
Asnarok INITIAL_ACCESS_VIA SQL injection
The Asnarok incident initially gained access through the SQL injection vulnerability in the firewall's web UI.
Derived Confidence 96% · Jack Rhysider EP 174 Details
“an attacker could enter in some commands there which would glitch out the user input handling mechanism of the firewall and allow the attacker to inject their own commands into the database”
The incident was named Asnarok by the Sophos team.
Explicit Confidence 99% · Craig Jones EP 174 Details
“We called it Asnarok”
Asnarok INVOLVES Sophos XG Firewall
The Asnarok attack affected publicly exposed Sophos XG Firewalls; the episode says a very large number of devices were compromised.
Explicit Confidence 98% · Andrew Brandt EP 174 Details
“essentially every firewall that was facing the public internet was affected by this bug”
Asnarok INVOLVES sophosfirewallupdate.com
The attack redirected firewalls to sophosfirewallupdate.com for update retrieval.
Explicit Confidence 99% · Craig Jones EP 174 Details
“it was a wget to a domain called sophosfirewallupdate.com”
Asnarok INVOLVES sophosproductupdate.com
The wider attack infrastructure also used sophosproductupdate.com as an update domain.
Explicit Confidence 99% · Andrew Brandt EP 174 Details
“there was sophosfirewallupdate.com and sophosproductupdate.com”
Sophos remotely deployed hot fixes to affected firewalls to close the attack loopholes without requiring reboots.
Explicit Confidence 99% · Andrew Brandt EP 174 Details
“They pushed out a hot fix to these firewalls”
Sophos developed an in-house kernel implant for covert telemetry and collection from selected threat-actor-controlled firewalls.
Derived Confidence 96% · Craig Jones EP 174 Details
“we developed a kernel implant in-house”
Kernel implant DEVELOPED_BY Sophos
The kernel implant was built by Sophos engineers and distributed only to selected machines of suspected threat actors.
Explicit Confidence 99% · Andrew Brandt EP 174 Details
“the security team decides they’re going to build something that they just call the implant”
Kernel implant USES sinkholing
The implant supported Sophos's broader effort to monitor and investigate malicious infrastructure; the episode separately describes Sophos sinkholing seized domains.
Derived Confidence 68% · Andrew Brandt EP 174 Details
“they wanted to sinkhole the domains and see what was connecting into them”
Sophos USES sinkholing
Sophos used sinkholing after taking control of the malicious update domains to observe connecting systems.
Explicit Confidence 99% · Andrew Brandt EP 174 Details
“they wanted to sinkhole the domains and see what was connecting into them”
Asnarok INVOLVES National Cyber Security Centre Netherlands
The Netherlands NCSC helped coordinate the response to the threat actor's server.
Explicit Confidence 98% · Craig Jones EP 174 Details
“through the NCSC in the Netherlands — they were kinda an intermediary”
Asnarok INVOLVES Dutch National High Tech Crime Unit
The Dutch National High-Tech Crime Unit obtained and enabled analysis of the threat actor's C2 server.
Explicit Confidence 99% · Craig Jones EP 174 Details
“the Dutch National High-Tech Crime Unit just jumped on this, and they managed to get hold of this C2 server”
Baja INVOLVES Apache module issue
The Baja attack involved an Apache module issue.
Explicit Confidence 99% · Craig Jones EP 174 Details
“It was an Apache module issue”
Baja INVOLVES Local privilege escalation
The Baja attack chained the Apache module issue with local privilege escalation.
Explicit Confidence 99% · Craig Jones EP 174 Details
“It was an Apache module issue and it was chained with a local privilege escalation”
The attackers used web shells to obtain direct remote access to Sophos Firewalls.
Explicit Confidence 99% · Andrew Brandt EP 174 Details
“they’re putting just regular old web shells on the firewalls”
Pacific Rim Campaign INVOLVES Asnarok
Asnarok was one of the incidents in the broader Pacific Rim Campaign.
Explicit Confidence 99% · Jack Rhysider EP 174 Details
“they called this whole series of incidents the Pacific Rim Campaign”
Pacific Rim Campaign INVOLVES Baja
Baja was another named attack in the Pacific Rim Campaign.
Explicit Confidence 99% · Andrew Brandt EP 174 Details
“they give this attack a nickname, Baja”
TStark USES libxselinux.so
TStark was observed developing and using the libxselinux.so userland rootkit on a threat-actor device.
Explicit Confidence 99% · Craig Jones EP 174 Details
“We found him working on a rootkit at the time. It was called libxselinux.so”
TStark EXPLOITS WebAssembly vulnerability
TStark was associated with exploiting a previously unknown WebAssembly vulnerability that injected an iframe into proxies.
Explicit Confidence 97% · Craig Jones EP 174 Details
“he’s got a completely new injection there, like a new vulnerability in web assembly”
TStark USES UEFI bootkit
TStark's group was observed experimenting with a UEFI bootkit on a firewall, although the attempt failed and bricked the device.
Uncertain Confidence 92% · Andrew Brandt EP 174 Details
“They were really trying to figure out if they could get this bootkit to run on a firewall”
Guan Tianfeng MEMBER_OF Sichuan Silence Information Security Technology
Guan Tianfeng was identified as a researcher at Sichuan Silence Technology Company Ltd.
Explicit Confidence 99% · Craig Jones EP 174 Details
“he was the researcher at this company called Sichuan Silence Technology Company Ltd.”
gbigmau SAME_AS Guan Tianfeng
The episode identifies the actor using the handle gbigmau as Guan Tianfeng.
Explicit Confidence 99% · Andrew Brandt EP 174 Details
“His name is Guan Tianfeng”
Pacific Rim Campaign ATTRIBUTED_TO Chinese state-sponsored threat actor
The episode attributes the Pacific Rim attack campaign to a Chinese state-sponsored threat actor; Jack presents this as the conclusion after the reported attribution to ABT31.
Attributed Confidence 97% · Jack Rhysider EP 174 Details
“the attack was carried out by ABT31, just a Chinese state-sponsored hacker group”
Pacific Rim Campaign TARGETS China
The episode repeatedly describes the actors and their research infrastructure as being located in China, especially Chengdu; this is not a claim that China itself was the victim target.
Explicit Confidence 86% · Craig Jones EP 174 Details
“we found these multiple companies. One of the simplest ways we actually found it, funnily enough — and this sounds so basic — is that we would look at devices that would be continually going up and down firmware versions. These threat actor devices would constantly put the new, latest firmware on, roll it back, new firmware, roll it back. They’d do this, I don’t know, maybe five or six times a day. Whereas normal firewall operation, it’s like, it’s a new firmware and it’s left. Then in a month it gets new firmware and then it’s left. So, these things just stood out like a sore thumb. So, some of it came really easy to find these threat actors. The more telemetry we had the easier it got. We started to really build a wide assortment of threat actors in China”
Cyberoam intrusion ATTRIBUTED_TO Chinese state-sponsored threat actor
The episode connects the earlier Cyberoam source-code theft to the later Chinese state-sponsored Pacific Rim activity, but the connection is presented as an investigative conclusion rather than direct proof in the episode.
Uncertain Confidence 82% · Jack Rhysider EP 174 Details
“This is starting to smell like a nation-state actor is behind this”
Volexity ASSOCIATED_WITH Uyghur diaspora support organization
Volexity investigated a customer firewall whose owner operated a charity supporting the Uyghur diaspora.
Explicit Confidence 98% · Andrew Brandt EP 174 Details
“the owners of those firewalls were operating a charity that supports the Uyghur diaspora”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T08:59:46.082354+00:00