The FBI has sought public assistance in identifying individuals behind a series of intrusions involving compromised edge devices in both public and private sectors. These intrusions have been linked to Chengdu-based researchers and their collaboration with Chinese government agencies, utilizing vulnerabilities in Sophos products, including CVE-2020-12271, to install malware like Asnarök. The FBI’s request follows detailed reports from Sophos, highlighting years-long surveillance and espionage campaigns targeting critical infrastructure in South and Southeast Asia, with some incidents affecting Europe and the United States. Chinese nation-state groups such as Volt Typhoon have targeted edge devices like routers and firewalls, exploiting them as operational relay boxes (ORBs) for obfuscating activities and conducting espionage. These devices are attractive targets due to their power, constant connectivity, and role in network infrastructure, making them ideal for both direct espionage and indirect attacks. The series of reports Sophos released were labelled “Pacific Rim”, detailing its ongoing conflict with Chinese threat actors over the past five (5) years. As stated in the report, these actors have increasingly targeted networking devices worldwide, including those from Sophos, exploiting vulnerabilities to install custom malware for network monitoring, credential theft, and proxy server operations. The attacks have impacted products from several well-known manufacturers, such as Fortinet, Cisco, and Sophos, and have been attributed to groups like Volt Typhoon, APT31, and APT41/Winnti. Sophos began confronting these threats in 2018 when its subsidiary, Cyberoam, was targeted, marking the start of focused attacks on network devices. These actors have advanced their techniques to include memory-only malware and sophisticated persistence methods, using compromised devices as proxy networks to evade detection. Sophos has countered by deploying custom implants on known compromised devices, gathering intelligence on the threat actors, including the deployment of a UEFI bootkit.