The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The U.S. Treasury Department announced sanctions on December 10, 2024, against Sichuan Silence Information Technology Company, Limited and its employee Guan Tianfeng over a 2020 cyberattack on Sophos firewalls. Treasury says malware was deployed to approximately 81,000 firewalls worldwide. A separate Justice Department announcement identifies the exploited vulnerability as CVE-2020-12271 and says a federal indictment charged Guan; an indictment is an allegation, not a conviction.
What happened in the 2020 firewall attack?
Treasury says Guan used a zero-day exploit between April 22 and 25, 2020, to deploy malware to approximately 81,000 firewalls owned by thousands of businesses worldwide. The Justice Department identifies the devices as Sophos firewalls and the vulnerability as CVE-2020-12271. Treasury’s December 10, 2024 announcement and the Justice Department’s case announcement describe the incident.
Treasury says the exploit was intended to steal data, including usernames and passwords. The Justice Department says the malware was also designed to deploy encryption software associated with a ransomware variant if a victim tried to remediate the infection, but those encryption efforts did not succeed. These descriptions of the malware and campaign are allegations in the criminal case, not findings after trial.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Why did Treasury sanction Sichuan Silence and Guan Tianfeng?
On December 10, 2024, Treasury’s Office of Foreign Assets Control (OFAC) designated Sichuan Silence Information Technology Company, Limited and Guan Tianfeng. Treasury describes Guan as a Chinese national and security researcher at the company at the time of the compromise. It describes Sichuan Silence as a Chengdu-based cybersecurity government contractor whose core clients are PRC intelligence services, and says the company provided cyber exploitation and other capabilities. Treasury also says a device used to position for the attack belonged to Guan’s employer.
#1 Best Overall
- XGS 88 (Hardware Only) - Next-generation firewall appliance only; add a Sophos subscription to enable IPS, web security, VPN, and advanced threat defense.
- Equipped with 4 x 2.5 GE copper ports, supporting up to 9.9 Gbps firewall performance for small offices and branch deployments.
- Purpose built next generation firewall hardware engineered for high performance, visibility, and reliable operation in business networks.
- SD-WAN optimization provides resilient connectivity and intelligent traffic routing across multiple WAN connections.
- VPN ready architecture supports secure site to site networking and encrypted remote employee access.
Treasury cited Executive Order 13694, as amended by Executive Order 13757. Its announcement says the cyber-enabled activity met the order’s criteria, including compromising networks supporting critical infrastructure. Treasury Acting Under Secretary for Terrorism and Financial Intelligence Bradley T. Smith said the action was intended to expose malicious cyber activity and hold those responsible accountable.
What does the Treasury sanction mean?
In its announcement, Treasury says property and interests in property belonging to designated persons that are in the United States or in the possession or control of U.S. persons are blocked and must be reported to OFAC. It also says entities owned, directly or indirectly, 50 percent or more by one or more blocked persons are blocked.
Rank #2
- XGS 118 (Hardware Only) - Next-generation firewall appliance only; add a Sophos subscription to enable IPS, web security, VPN, and advanced threat defense.
- 9 x 2.5 GE copper ports and 1 SFP fiber port, delivering up to 15.5 Gbps firewall performance for mid sized organizations.
- Purpose built next generation firewall hardware engineered for high performance, visibility, and reliable operation in business networks.
- SD-WAN optimization provides resilient connectivity and intelligent traffic routing across multiple WAN connections.
- VPN ready architecture supports secure site to site networking and encrypted remote employee access.
Treasury says U.S. persons generally may not transact in property or interests in property of designated or otherwise blocked persons unless OFAC authorizes the transaction or an exemption applies. This is a summary of the announcement, not individualized legal guidance. Sanctions records, authorizations and applicable rules can change; consult current OFAC records and qualified counsel for a present-day determination.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhat is the status of the criminal case?
The Justice Department announced in December 2024 that a federal court had unsealed an indictment charging Guan. The indictment alleges that Guan and co-conspirators developed and deployed malware exploiting the vulnerability. The DOJ release expressly notes that an indictment is merely an allegation and that defendants are presumed innocent until proven guilty beyond a reasonable doubt. It does not establish a conviction.
Quick Recap
Best Value
- XGS 128 (Hardware Only) - Next-generation firewall appliance only; add a Sophos subscription to enable IPS, web security, VPN, and advanced threat defense.
- 9 x 2.5 GE copper ports and 1 SFP fiber port, providing up to 19.1 Gbps firewall throughput for larger offices.
- Purpose built next generation firewall hardware engineered for high performance, visibility, and reliable operation in business networks.
- SD-WAN optimization provides resilient connectivity and intelligent traffic routing across multiple WAN connections.
- VPN ready architecture supports secure site to site networking and encrypted remote employee access.
Rank #4
- XGS 118 with 3 Years Standard Protection - Next-generation firewall appliance with Standard Protection subscription providing firewall, VPN, intrusion prevention, web security, and application control, managed through Sophos Central for unified policies and reporting.
- 9 x 2.5 GE copper ports and 1 SFP fiber port, delivering up to 15.5 Gbps firewall performance for mid sized organizations.
- Protects users from ransomware, malware, phishing, and intrusion attempts before they reach endpoints or applications.
- SD-WAN features deliver reliable, optimized application performance and intelligent multi link failover.
- Includes Standard Protection – Comprehensive security package with firewall, intrusion prevention, VPN, web security, and application control to defend against everyday threats and keep business operations safe.
Rank #3
- Network administrators' main fears are that SSL inspection will have a performance impact or cause something to break, impacting the user experience. Sophos Firewall removes the blind spots caused by encrypted traffic by allowing you to use SSL inspection while maintaining performance efficiency.
- TLS 1.3 Decryption: Remove an enormous blind spot with intelligent TLS inspection that’s fast and effective, supporting the latest standards with extensive exceptions and point-and-click policy tools to make your job easy.
- Deep Packet Inspection: Stop the latest ransomware and breaches with high-performance streaming deep packet inspection, including next-gen IPS, web protection, and app control, as well as deep learning and sandboxing powered by SophosLabs Intelix.
- Sophos Firewall and the XGS Series appliances with dedicated Xstream Flow Processors enable the ultimate in application acceleration, high-performance TLS inspection, and powerful threat protection
- Specifications: Firewall throughput: 35,000 Mbps| Firewall IMIX: 20,000 Mbps | Firewall Latency (64 byte UDP): 4 µs | IPS throughput: 7,000 Mbps | Threat Protection throughput: 1,400 Mbps
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
