CISA, FBI, and NSA Warn: China-Backed APTs Compromise Global Critical Infrastructure
Executive Summary
In June 2024, leading international cybersecurity agencies—including the CISA, FBI, and NSA—issued a joint advisory detailing the extensive, multi-year espionage campaign attributed to Chinese state-backed actors such as Salt Typhoon. These APTs have targeted critical infrastructure sectors including telecommunications, government, transportation, and defense, largely by exploiting known vulnerabilities in network hardware like routers and firewalls since at least 2021. Attackers leveraged tactics such as modifying access control lists, opening non-standard ports, establishing persistent footholds, and actively capturing sensitive network traffic for credential harvesting, with the aim of gaining long-term, stealthy access and potential disruption capability across global networks.
This incident underscores a major strategic escalation from pure data theft to pre-positioning for possible future disruption of vital services. Organizations face heightened pressure to implement robust detection, network segmentation, and security hardening, as state-sponsored campaigns become more brazen and influential across global critical systems.
Why This Matters Now
Chinese APT activity has shifted from traditional espionage to deep infiltration and potential control of critical infrastructure worldwide. The urgency lies in their persistent access tactics and exploitation of networking devices, emphasizing the need for organizations to prioritize patching, monitoring, and zero trust defenses immediately to mitigate this escalating nation-state threat.
Attack Path Analysis
Chinese state-sponsored threat actors exploited known vulnerabilities in network edge devices to gain initial access, leveraging misconfigurations and vulnerable services to enter target environments. They escalated privileges by manipulating device configurations and credentials, allowing persistent administrative access. Using compromised routers and trusted links, the attackers moved laterally into broader enterprise networks and additional infrastructure. To maintain control, they created covert tunnels, enabled unauthorized services like SSH, and set up C2 channels for persistent communications. Sensitive data and credentials were collected via packet capture and exfiltrated through custom tunnels and disguised outbound traffic. The attackers’ long-term persistence allowed for continued espionage and positioned them to potentially disrupt or degrade critical network operations.
Kill Chain Progression
Initial Compromise
Description
Attackers exploited publicly known vulnerabilities (e.g., CVE-2024-21887, CVE-2024-3400, CVE-2023-20273) in edge routers and firewalls to gain initial access to network infrastructure.
Related CVEs
CVE-2024-21887
CVSS 9.8A command injection vulnerability in Ivanti Connect Secure and Ivanti Policy Secure web components allows remote attackers to execute arbitrary commands.
Affected Products:
Ivanti Connect Secure – 9.x, 10.x
Ivanti Policy Secure – 9.x, 10.x
Exploit Status:
exploited in the wildCVE-2024-3400
CVSS 9.8An arbitrary file creation vulnerability in Palo Alto Networks PAN-OS GlobalProtect allows unauthenticated remote code execution on firewalls.
Affected Products:
Palo Alto Networks PAN-OS – < 10.2.3
Exploit Status:
exploited in the wildCVE-2023-20273
CVSS 7.2A post-authentication command injection vulnerability in Cisco IOS XE Web Management User Interface allows privilege escalation.
Affected Products:
Cisco IOS XE – 16.x, 17.x
Exploit Status:
exploited in the wildCVE-2023-20198
CVSS 10An authentication bypass vulnerability in Cisco IOS XE Web User Interface allows remote attackers to gain unauthorized access.
Affected Products:
Cisco IOS XE – 16.x, 17.x
Exploit Status:
exploited in the wildCVE-2018-0171
CVSS 9.8A remote code execution vulnerability in Cisco IOS and IOS XE Smart Install allows unauthenticated attackers to execute arbitrary code.
Affected Products:
Cisco IOS – 12.x, 15.x
Cisco IOS XE – 16.x
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Create Account: Local Account
Command and Scripting Interpreter: Unix Shell
Valid Accounts
Indicator Removal on Host: Timestomp
Network Service Discovery
Remote Services: SSH
Network Sniffing
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Security of system components and software
Control ID: 6.4.3
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
CISA Zero Trust Maturity Model (ZTMM) 2.0 – Asset Management & Visibility
Control ID: 1.2.1
NIS2 Directive – Security in network and information systems
Control ID: Article 21(2)(c)
DORA (Digital Operational Resilience Act) – ICT risk management framework
Control ID: Article 9
PCI DSS 4.0 – Audit Log Generation
Control ID: 10.2.1
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Telecommunications
Critical exposure to Salt Typhoon's global espionage targeting backbone routers, provider edge devices, and telco infrastructure for persistent network access and data collection.
Government Administration
High-priority target for Chinese APTs conducting espionage and pre-positioning attacks against government networks, requiring enhanced zero trust segmentation and threat detection capabilities.
Transportation
Vulnerable to PRC-linked threat actors targeting transportation sector networks through router compromises, lateral movement, and persistent access for potential future operational disruption.
Defense/Space
Strategic target for nation-state espionage operations exploiting network devices and trusted connections, necessitating encrypted traffic protection and multicloud visibility controls.
Sources
- CISA, FBI, NSA Warn of Chinese 'Global Espionage System'https://www.darkreading.com/cybersecurity-operations/cisa-fbi-nsa-warn-chinese-global-espionage-systemVerified
- CISA and Partners Release Joint Advisory on Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage Systemshttps://www.cisa.gov/news-events/alerts/2025/08/27/cisa-and-partners-release-joint-advisory-countering-chinese-state-sponsored-actors-compromiseVerified
- Salt Typhoon hacks 600 global organizations via Cisco, Ivanti, Palo Alto flawshttps://www.gat.report/70870/salt-typhoon-hacks-600-global-organizations-via-cisco-ivanti-palo-alto-flaws/Verified
- NSA, FBI, CISA, and Japanese Partners Release Advisory on PRC-Linked Cyber Actorshttps://www.cisa.gov/news-events/alerts/2023/09/27/nsa-fbi-cisa-and-japanese-partners-release-advisory-prc-linked-cyber-actorsVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Implementing CNSF Zero Trust controls such as segmentation, encrypted traffic, egress enforcement, and continuous visibility would have limited the attacker's movement, detected abnormal activity, and prevented both data exfiltration and persistent access. Aviation of microsegmentation, inline IPS, and secure traffic controls disrupts each critical phase of this multi-stage nation-state espionage campaign.
Control: Cloud Firewall (ACF)
Mitigation: Prevents unauthorized inbound connections and detects exploit traffic.
Control: Multicloud Visibility & Control
Mitigation: Rapidly detects config changes and privilege escalation attempts.
Control: Zero Trust Segmentation
Mitigation: Blocks unauthorized lateral movement and enforces least privilege network access.
Control: Inline IPS (Suricata)
Mitigation: Detects and blocks known C2 patterns and custom tunnels.
Control: Egress Security & Policy Enforcement
Mitigation: Prevents or flags unauthorized data transfers and suspicious outbound flows.
Enables early detection of persistence mechanisms and anomalous behaviors.
Impact at a Glance
Affected Business Functions
- Telecommunications
- Government Operations
- Transportation
- Lodging
- Defense
Estimated downtime: 7 days
Estimated loss: $5,000,000
Potential exposure of sensitive communications, government data, and defense information due to prolonged unauthorized access.
Recommended Actions
Key Takeaways & Next Steps
- • Prioritize segmentation of critical network assets using Zero Trust Segmentation to restrict lateral movement.
- • Enforce strong egress security policies and encryption for all outbound and east-west traffic to prevent data exfiltration and intercepts.
- • Enable continuous centralized visibility and monitoring on cloud and edge control planes to detect unauthorized configuration and privilege changes.
- • Deploy inline network IPS and threat detection capabilities to block exploit attempts, C2 activity, and anomalous flows in real-time.
- • Regularly audit and promptly patch all network edge devices and cloud workloads, ensuring microsegmentation and encryption are always enforced.
