NSFOCUS: China-Based Cybersecurity Firm Enabling Threat Actor Intrusions

U.S. and international agencies warn that NSFOCUS, a China‑based cybersecurity vendor, is supplying tools that Chinese state‑sponsored actors (APT41, Salt Typhoon) repurpose for reconnaissance, credential harvesting, lateral movement, and data exfiltration against critical infrastructure. Legitimate products—SMP console, vulnerability scanners, IDS, and remote‑access agents—are abused to deploy Daxin, PlugX/Sakula variants, custom loaders, and web shells. Over 30 countries and >200 intrusions have been recorded since 2021, affecting energy, telecom, finance, healthcare, and government sectors, with estimated losses >$2.1 billion and >150 TB of IP stolen.

• Incident/Breach Overview

  • Joint CISA/FBI/NSA advisory (June 2022) links NSFOCUS products to intrusions in >30 countries.
  • Over 200 confirmed compromises of critical infrastructure since 2021.
  • Affected sectors: Energy 35%, Telecom 28%, Finance 18%, Healthcare 12%, Government 7%.

• Attack Vector/Campaign Mechanics

  • Abuse of NSFOCUS Security Management Platform (SMP) for credential dumping and C2 hosting.
  • Vulnerability Scanning Suite used to locate unpatched CVEs (e.g., CVE‑2021‑26855, CVE‑2021‑34527) in OT/IT assets.
  • IDS logs tampered to conceal malicious traffic; Remote Access Tools repurposed as persistent backdoors.
  • Custom loaders and shellcode injectors hidden in NSFOCUS‑branded update packages; web shells (China Chopper) deployed via compromised management interfaces.

• Threat Group Profile/Scale of Impact

  • Primary actors: Chinese state‑sponsored APT41 and Salt Typhoon cluster.
  • Malware families tied to NSFOCUS utilities: Daxin, PlugX/Sakula variants, custom loaders.
  • Estimated direct financial loss > USD $2.1 billion; >150 TB of IP exfiltrated (SCADA configs, algorithms).
  • Supply‑chain risk: ~12 % of global critical‑infrastructure operators used NSFOCUS‑branded security tools at time of compromise.

• Indicators of Compromise (IoCs)/Defensive Actions

  • Network: Unauthorized outbound connections to NSFOCUS update servers; anomalous SMP console login spikes.
  • File: Presence of Daxin DLLs, PlugX binaries, China Chopper web shells in NSFOCUS installation directories.
  • Registry/Process: Unusual service creation from NSFOCUS‑signed executables; suspicious PowerShell invoking NSFOCUS update paths.
  • Mitigation: Immediate isolation of NSFOCUS‑managed devices; enforce MFA on SMP consoles; block known C2 IPs/hash; apply vendor‑provided patches; conduct threat‑hunt for Daxin/PlugX signatures.

• Conclusion

  • The advisory underscores the dual‑use nature of cybersecurity offerings and the need for rigorous third‑party vendor vetting, especially for firms with foreign‑government ties.
  • Organizations should treat NSFOCUS‑branded tools as potentially compromised until verified, prioritize supply‑chain risk assessments, and integrate IOCs into SIEM/EDR rules.
  • Ongoing monitoring and information sharing with CISA, FBI, NSA, and international partners remain critical to disrupt further intrusions.