Chinese Government Hackers Exposed: Concealing Themselves within Cisco Router Firmware

Chinese state-sponsored Advanced Persistent Threat (APT) group, BlackTech, has recently been discovered hacking into network edge devices and using firmware implants to infiltrate corporate networks of U.S. and Japanese multinational organizations. The National Security Agency (NSA), the Federal Bureau of Investigation (FBI), the Cybersecurity Infrastructure and Security Agency (CISA), and Japan’s National Institute of Information and Communications Technology (NISC) have jointly issued a warning about this ongoing cyber espionage campaign.

BlackTech has been observed modifying router firmware on Cisco routers to maintain persistence and hop between subsidiary offices and headquarters in Japan and the United States. The attackers target branch routers, commonly found in remote branch offices, to gain initial access, and then leverage these compromised devices to blend in with legitimate corporate network traffic and reach other victims within the targeted network.

The APT group, which has been active since at least 2010, targets a wide range of industries, including government, industrial, technology, media, electronics, and telecommunication sectors. Notably, it also targets entities that support the military sectors of the U.S. and Japan. BlackTech has a history of using custom malware, dual-use tools, and tactics such as disabling logging on routers to evade detection.

## The Modus Operandi: Firmware Implants and SSH Backdoors

BlackTech hackers have been observed compromising Cisco routers through customized firmware implants, which they enable and disable using specially crafted TCP or UDP packets. In some cases, the group has been caught replacing the firmware of Cisco IOS-based routers with malicious firmware. This malicious firmware establishes persistent backdoor access and conceals future malicious activities. The modified firmware exploits a built-in SSH backdoor, allowing the attackers to maintain access to the compromised routers without leaving any logged connections. Additionally, the attackers bypass the routers’ built-in security features by using older legitimate firmware files and modifying them in memory to evade firmware signature checks and detection.

## Recommendations and Response

In light of these attacks, the joint advisory from the NSA, FBI, CISA, and NISC provides several recommendations for defenders. They emphasize the importance of monitoring inbound and outbound connections from network devices, both to external and internal systems, and checking logs for successful and unsuccessful login attempts. Defenders are also encouraged to upgrade devices to those with secure boot capabilities, review logs generated by network devices, and monitor for unauthorized reboots, operating system version changes, configuration modifications, or attempts to update firmware. These recommendations aim to detect and mitigate potential attacks by monitoring and analyzing network activity.

Cisco has responded to the incident by acknowledging that the most prevalent initial access vector in these attacks involves stolen or weak administrative credentials, rather than any vulnerabilities in Cisco‘s systems. The company emphasized that installing compromised software through downgrading to older firmware only affects legacy devices, and modern Cisco routers that support secure boot are not susceptible to this method. Additionally, Cisco denied having any knowledge of their code-signing certificates being stolen to facilitate attacks against their infrastructure devices.

## The Larger Context: Persistent State-Sponsored Cyber Threats

The discovery of BlackTech’s activities serves as a reminder of the persistent threat posed by state-sponsored cyber espionage campaigns. Countries such as China have a long history of engaging in cyber operations to further their political, economic, and military interests. These operations often target sensitive sectors, critical infrastructure, and even governments. While this particular incident focuses on BlackTech’s targeting of U.S. and Japanese multinational companies, it highlights the need for nations and organizations to remain vigilant and proactive in defending against such threats.

## The Philosophy of Cybersecurity: Balancing Innovation and Security

This incident also raises broader philosophical questions surrounding cybersecurity, innovation, and national interests. In an increasingly interconnected world, digital technologies have revolutionized industries, spurred economic growth, and transformed societies. However, these advancements come with inherent risks, as demonstrated by incidents such as the BlackTech attacks.

As societies continue to enjoy the benefits of technological innovations, it becomes imperative to strike a delicate balance between promoting innovation and ensuring robust cybersecurity. Governments and organizations must invest in cybersecurity measures that protect critical infrastructure, sensitive data, and intellectual property without stifling innovation. This balancing act requires close collaboration between policymakers, industry leaders, and cybersecurity experts to establish regulatory frameworks, standards, and best practices that foster a secure and resilient digital ecosystem.

## The Urgency of Strengthening Cyber Defenses

The BlackTech attacks underscore the urgent need for organizations to strengthen their cyber defenses, particularly when it comes to network security. As the attack surface expands with the proliferation of remote work, cloud computing, and the Internet of Things (IoT), organizations must prioritize comprehensive cybersecurity measures to protect their networks, data, and operations.

Implementing multi-layered security approaches that include strong network segmentation, regular vulnerability assessments, continuous network monitoring, and incident response planning can significantly bolster defenses against sophisticated threats like BlackTech. In addition, organizations should regularly update and patch their network devices, leverage encryption and other security protocols, and provide security awareness training for employees to mitigate the risk of falling victim to social engineering techniques used by attackers.

## Conclusion

The revelation of BlackTech’s use of firmware implants to infiltrate corporate networks is a significant development in the ongoing battle against state-sponsored cyber threats. It serves as a stark reminder of the complex and evolving nature of cybersecurity challenges in today’s interconnected world. Governments, organizations, and individuals must remain vigilant, proactive, and continuously adapt their cybersecurity strategies to defend against these persistent threats. By taking a holistic approach to cybersecurity, prioritizing network security, and fostering collaboration between public and private entities, we can increase the resilience of our digital ecosystems and safeguard against future attacks.