An Espionage System: NSA, CISA, & Partners Expose Chinese APT Groups

According to Joint Cybersecurity Advisory, the NSA, CISA, FBI and partners from more than a dozen allied nations released a multinational alert exposing how Chinese state-sponsored APT groups are compromising telecommunications, government and other critical networks to feed a global espionage system.

The advisory notes that PRC state-sponsored actors are targeting networks globally, including telecommunications, government, transportation, lodging and military infrastructure networks, and that attackers pivot through customer edge and provider edge routers to maintain long-term persistence. It identifies overlapping threat clusters such as Salt Typhoon, OPERATOR PANDA, RedMike, UNC5807 and GhostEmperor as part of coordinated Chinese state-linked operations.

Investigators say attackers rely heavily on publicly known CVEs rather than zero-days, with notable exploits including CVE-2024-21887, CVE-2024-3400, CVE-2023-20198 + CVE-2023-20273 and CVE-2018-0171. The advisory describes persistence techniques like modifying ACLs, enabling SSH on non-standard ports and covert tunnels using GRE and IPsec, and notes exfiltration via hijacking peering connections between ISPs. Defenders are urged to patch exposed edge devices and implement mitigations such as restricting management services and auditing configurations.