China state-sponsored actors target networks globally

People’s Republic of China (PRC) state-sponsored cyber threat actors are targeting networks globally, including but not limited to telecommunications, government, transportation, lodging, and military infrastructure networks.  

While these actors focus on large backbone routers of major telecommunications providers, as well as provider edge (PE) and customer edge (CE) routers, they also leverage compromised devices and trusted connections to pivot into other networks. These actors often modify routers to maintain persistent, long-term access to networks. 

The data stolen through this activity against foreign telecommunications and internet service providers (ISPs), as well as intrusions in the lodging and transportation sectors, ultimately can provide Chinese intelligence services with the capability to identify and track their targets’ communications and movements around the world.

We encourage network defenders of critical infrastructure organisations, especially telecommunications organisations, to perform threat hunting, and, when appropriate, incident response activities.

If malicious activity is suspected or confirmed, organisations should consider all mandatory reporting requirements to relevant agencies and regulators under applicable laws and regulations, and any additional voluntary reporting to appropriate agencies, such as cyber security or law enforcement agencies who can provide incident response guidance and assistance with mitigation.