Chinese APTs Cash In on Years of Edge Device Attacks

Sophos analysis describes a multi-year evolution of Chinese APT activity that began with large-scale attacks against Internet-facing edge/networking devices and progressed to stealthier, targeted operations against high-value organizations; notable techniques include an AWS IAM-based pivot, the Cloud Snooper rootkit, UEFI bootkits, and the use of operational relay box networks to obscure attribution.