Inside Sophos' 5-Year War With the Chinese Hackers Hijacking Its Devices

Sophos uncovered a multi-year intrusion campaign by Chinese-linked hackers who first compromised a Cyberoam display machine and then used rootkits and zero-day exploits in Sophos appliances to deploy the Asnarök trojan and build a global botnet of compromised firewalls ("operational relay boxes"). The campaign involved exploitation of multiple zero-days, mass infections of tens of thousands of devices, and strategic targeting of security products to enable broader operations against customers.