CISA and NCSC advisory on defending against China-nexus covert networks of compromised devices
CISA and the UK NCSC, with co-sealing partners, published advisory AA26-113A on China-nexus cyber actors' use of large, dynamic covert networks of compromised devices, mainly SOHO routers and IoT devices. These networks are shared by multiple threat actors and each may contain hundreds of thousands of endpoints. This makes static IP blocklists far less effective, a problem Mandiant described as "IOC extinction" in a May 2024 blog. The advisory does not catalogue individual networks, because they change too quickly. Instead it describes a generalized structure and defensive guidance for it.
Technical Details
- Typical covert network architecture: the actor connects through an on-ramp or entry node, usually a VPS. Traffic is then relayed through multiple compromised traversal nodes and leaves through an exit node, usually in the same geographic region as the target.
- New nodes are continually added as old devices are patched or removed. Networks also change in response to defensive or legal action and to new exploits against other technologies.
- MITRE ATT&CK mapping: Compromise Infrastructure: Botnet, Compromise Infrastructure: Network Devices, and Acquire Infrastructure: Virtual Private Server.
- The advisory names no specific CVEs, IOCs, malware or threat actors.
Remediation
- Baseline: map network edge devices, baseline normal connections to VPNs (for example, flag unexpected consumer broadband ranges), use dynamic threat feeds that include covert network infrastructure, and enforce MFA for remote access.
- Higher-risk organizations: use IP and geographic allow lists for VPNs, apply zero trust policies, enforce machine certificates for SSL connections, reduce internet-facing exposure, and profile edge activity with machine learning.
- Advanced capabilities: track China-nexus covert networks as APTs in their own right, hunt for connections from SOHO router and IoT hosting ranges, map networks via banners and certificates, build dynamic blocklists, and use NetFlow to find new nodes.
- General hygiene: patch promptly, segment networks, monitor and log security events, prevent lateral movement and restrict third-party access.
Linha do tempo
-
CISA and NCSC advisory on defending against China-nexus covert networks of compromised devices
ler a análise desta fonte ocultar
CISA and the UK NCSC, with co-sealing partners, published advisory AA26-113A on China-nexus cyber actors' use of large, dynamic covert networks of compromised devices, mainly SOHO routers and IoT devices. These networks are shared by multiple threat actors and each may contain hundreds of thousands of endpoints. This makes static IP blocklists far less effective, a problem Mandiant described as "IOC extinction" in a May 2024 blog. The advisory does not catalogue individual networks, because they change too quickly. Instead it describes a generalized structure and defensive guidance for it.
Technical Details
- Typical covert network architecture: the actor connects through an on-ramp or entry node, usually a VPS. Traffic is then relayed through multiple compromised traversal nodes and leaves through an exit node, usually in the same geographic region as the target.
- New nodes are continually added as old devices are patched or removed. Networks also change in response to defensive or legal action and to new exploits against other technologies.
- MITRE ATT&CK mapping: Compromise Infrastructure: Botnet, Compromise Infrastructure: Network Devices, and Acquire Infrastructure: Virtual Private Server.
- The advisory names no specific CVEs, IOCs, malware or threat actors.
Remediation
- Baseline: map network edge devices, baseline normal connections to VPNs (for example, flag unexpected consumer broadband ranges), use dynamic threat feeds that include covert network infrastructure, and enforce MFA for remote access.
- Higher-risk organizations: use IP and geographic allow lists for VPNs, apply zero trust policies, enforce machine certificates for SSL connections, reduce internet-facing exposure, and profile edge activity with machine learning.
- Advanced capabilities: track China-nexus covert networks as APTs in their own right, hunt for connections from SOHO router and IoT hosting ranges, map networks via banners and certificates, build dynamic blocklists, and use NetFlow to find new nodes.
- General hygiene: patch promptly, segment networks, monitor and log security events, prevent lateral movement and restrict third-party access.