Chinese VPN Service as Attack Platform?
Summary: RSA Research identified a network of Chinese-language VPN services it calls "Terracotta VPN," with more than 1,500 nodes worldwide, many of them compromised Windows servers harvested without the owners' knowledge, including systems at a Fortune 500 hotel chain, a hi-tech manufacturer, a law firm, a doctor's office and a county government. RSA says suspected nation-state actors leveraged at least 52 Terracotta nodes against Western government and commercial targets, and that 11 of the 13 IP addresses (85%) used in one espionage campaign against a defense contractor were Terracotta nodes.
Key Takeaway: The group tied to Terracotta, tracked as Shell_Crew and Deep Panda, has been linked to the OPM breach and the Anthem and Premera breaches, and its traffic blends in with legitimate VPN use - so an attacker's origin address tells you little about who is behind it.
Read the original at Krebs on Security ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026