Report: Sophos analyzes intrusions

"Sophos analysts identified a series of hacking campaigns that had started with indiscriminate mass exploitation of its products but eventually became more stealthy and targeted, hitting 

• Nuclear energy suppliers and regulators, 
• Military targets including a military hospital, 
• Telecoms, 
• Government and 
• Intelligence agencies, and the 
• Airport of one national capital. 

"While most of the targets —which Sophos declined to identify in greater detail —were in South and Southeast Asia, a smaller number were in Europe, the Middle East, and the United States.

"Sophos' report ties those multiple hacking campaigns —with varying levels of confidence —to Chinese state-sponsored hacking groups including those known as APT41, APT31, and Volt Typhoon, the latter of which is a particularly aggressive team that has sought the ability to disrupt critical infrastructure in the US, including power grids. 

"But the common thread throughout those efforts to hack Sophos' devices, the company says, is not one of those previously identified hackers groups but instead a broader network of researchers that appears to have developed hacking techniques and supplied them to the Chinese government. 

"Sophos' analysts tie that exploit development to an academic institute and a contractor, both around Chengdu: Sichuan Silence Information Technology —a firm previously tied by Meta to Chinese state-run disinformation efforts —and the University of Electronic Science and Technology of China."