Sophos has unveiled a comprehensive report titled “Pacific Rim,” detailing a five-year defensive and counter-offensive operation against Chinese nation-state adversaries targeting its firewall products. The accompanying TTP write-up traces the campaigns from mass exploitation such as Asnarök (CVE-2020-12271) to targeted attacks with rootkits and what X-Ops believes is the first bootkit observed on a firewall.
X-Ops built a specialized kernel implant to deploy to devices that Sophos had high confidence were controlled by groups conducting malicious exploit research
According to the timeline, the implant was built in spring 2020 during the Asnarök postmortem and allowed remote file and log collection without visible userland artifacts. The cybersecurity company utilized their security product to deploy backdoors. Would this qualify as a hack back? A hack back refers to launching a counterattack aimed at disabling or collecting evidence against the perpetrator.