CISA Releases Guide to Hunt and Mitigate Chinese State-Sponsored Threats

According to CISA, the Cybersecurity and Infrastructure Security Agency unveiled a comprehensive Cybersecurity Advisory designed to empower network defenders to detect, hunt, and mitigate the activities of advanced persistent threat actors linked to the People’s Republic of China.

The guide, produced in coordination with the NSA, the FBI, and allied partners in Australia, Canada, the United Kingdom and beyond, synthesises IOCs, technical observations and countermeasure recommendations to safeguard global critical infrastructure such as telecommunications, government, transportation and lodging.

It notes that state-sponsored actors—often tracked as Salt Typhoon, RedMike, and UNC5807—have exploited known flaws in backbone routers and provider-edge devices to gain long-term access, and highlights CVE-2023-20198, CVE-2024-21887 and CVE-2024-3400 among others.

The advisory emphasises a threat-hunting playbook that includes auditing device configurations, monitoring management services on non-standard ports, and tracking embedded Linux container activity such as Cisco Guest Shell, while also urging patching of CVEs including CVE-2024-21887, CVE-2024-3400, CVE-2023-20273, CVE-2023-20198 and CVE-2018-0171. It also recommends hardening measures like VRFs, disabling unused services, and adopting MITRE D3FEND countermeasures to reduce attack surface.

Published on 28 August 2025, the guidance is co-published with partner agencies across North America, Europe and the Asia-Pacific to support global situational awareness and defensive refinement.