China-linked malware targeted secure networks in 'multiple governments'

The United States' Cybersecurity and Infrastructure Security Agency (CISA), working with security vendor Symantec, has found an extremely sophisticated network attack tool that can invisibly create backdoors, has been plausibly linked to Chinese actors, and may have been in use since 2013. Symantec's threat hunting team has …

[Paul Crawford]

I was thinking "How on earth can it do all those things undetected?" and then I read:

Symantec says it ships as a Windows kernel driver and works to hijack legitimate TCP/IP connections.

Reminds me why our one "this has to be windows" server is firewalled from sending data out, not just connections coming in.

[Anonymous Coward]

I thought windows didn't allow unsigned kernel drivers to be loaded? Is this thing signed by a trusted key? Whose? :S

[Anonymous Coward]

Yeah, Windows.

More needs not be said, really.