US names Chinese national it alleges was behind 2020 attack on Sophos firewalls

US authorities allege that a China-linked security researcher and his employer exploited a critical SQL injection (CVE-2020-12271) in Sophos XG firewalls in April 2020, compromising approximately 81,000 devices (including at least one US government agency). The attackers used a spoofed domain (sophosfirewallupdate.com) to deliver malware that exfiltrated firewall data to a Chinese IP, attempted (but failed) to pivot to deliver Ragnarok ransomware after patching was detected, and have since been indicted, sanctioned, and made the subject of a multi-million-dollar reward.