PRC router espionage shows how trust relationships become access paths

At a glance

What this is: This is SafeBreach's analysis of a CISA-led advisory on PRC espionage campaigns that exploited network devices, trust relationships, and authentication paths to gain persistence and collect data.

Why it matters: It matters because trusted infrastructure links, service accounts, and administrative access paths can become durable attack routes, which means IAM, PAM, and network teams need shared control over privileged connectivity.

By the numbers:

• Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, followed by inadequate monitoring and logging at 37% and over-privileged accounts at 37%.

👉 Read SafeBreach's analysis of the CISA advisory on PRC espionage campaigns

Context

PRC espionage campaigns against telecom and government infrastructure show how network trust can be weaponised when edge devices, management protocols, and inter-provider links are treated as operational conveniences instead of governed access paths. In identity terms, those routers and service channels behave like high-value non-human identities because they can be authenticated, modified, and reused at scale.

The article's primary point is not the existence of advanced adversaries, but the control gap created when trusted connections outlive their intended purpose. That is familiar territory for IAM and PAM teams, because the same governance failure appears whenever privileged access, service credentials, or administrative pathways are left standing without tight lifecycle control.

For security programmes, this is a cross-domain problem: network hardening, logging, authentication, and access governance all have to align. The starting position is unfortunately typical, because many enterprises still separate network operations from identity governance even when attackers are using both at once.

Key questions

Q: What breaks when device trust is not part of privileged access decisions?

A: Privilege becomes detached from real session risk. A user or workload may still be authenticated, but the device may be compromised, unmanaged, or operating from an unexpected context. Without device trust, security teams lose a major signal for deciding whether elevated access should be granted, narrowed, or denied.

Q: Why does this kind of kernel flaw matter to identity and access teams?

A: Because it compromises the host material that identity systems rely on. SSH host keys support trust relationships, and shadow-file exposure can support offline credential cracking. When those assets leak, the issue is not only infrastructure hardening. It becomes an identity confidence problem that can affect privileged access across Linux estates.

Q: How do organisations know if privileged access controls are working?

A: They are working when standing privilege declines, privileged sessions are shorter, and elevated access is granted only when needed. If high-risk access remains persistent or repeatedly reappears after review, the control model is not reducing blast radius.

Q: Who is accountable when attackers abuse trusted interconnections for espionage?

A: Accountability is shared across network operations, identity governance, and security leadership because the abused asset is both infrastructure and access control. Frameworks such as NIST CSF and NIST SP 800-53 expect coordinated governance of protection, detection, and authorization, so ownership must extend beyond the network team.

Technical breakdown

How trusted router access becomes an attack path

The campaign begins with exploitation of internet-facing edge devices and remote management surfaces, often using known CVEs rather than novel exploits. Once inside, attackers abuse the trust already embedded in provider-to-provider and provider-to-customer links. That matters because backbone routers, management VRFs, and interconnects are not just network assets, they are access brokers that can forward authenticated traffic, configuration changes, and administrative control. In practice, the attacker is not breaking the network so much as inheriting the privileges that the network already grants to trusted operators.

Practical implication: treat interconnects and management endpoints as privileged access paths, not generic infrastructure.

Authentication abuse, ACL changes, and persistent access

After entry, the actors modified ACLs, enabled services on unusual ports, and altered TACACS+ and RADIUS-related behavior to preserve access. This is classic persistence through control-plane abuse. The important mechanism is that authentication infrastructure and router configuration can be changed in ways that make attacker activity look like legitimate administration, especially if off-box telemetry is weak. In identity terms, the abuse resembles a standing privileged session that was never fully scoped or terminated, except the session lives inside device configuration and AAA flow rather than a human login.

Practical implication: monitor configuration drift and AAA changes as identity events, not only as network changes.

Why exfiltration blends into normal management traffic

The exfiltration phase relies on traffic channels that defenders often trust by default, including GRE, IPsec tunnels, and custom SFTP tooling. The campaign also harvested TACACS+ and RADIUS traffic and enumerated router configurations, BGP routes, and subscriber records. That combination matters because the attacker is using management-plane visibility to turn operational metadata into surveillance intelligence. For identity teams, the lesson is that secrets, credentials, and authoritative route data all sit inside the same trust envelope once administrative access is compromised.

Practical implication: validate what management traffic is allowed to carry before attackers turn it into an exfiltration channel.

Threat narrative

Attacker objective: The objective is persistent access to telecom and government networks that supports surveillance, credential capture, and long-term espionage.

1. Entry occurred through exploitation of known vulnerabilities in internet-facing network edge devices and trusted interconnection points.
2. Escalation followed when attackers modified ACLs, enabled services on non-standard ports, and manipulated TACACS+ and RADIUS flows to preserve privileged access.
3. Impact came from long-term persistence, credential harvesting, route and configuration collection, and covert exfiltration through tunnels and alternative transfer protocols.

Breaches seen in the wild

• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.
• Coupang Signing Key Breach — Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Trusted infrastructure is becoming an identity problem, not only a network problem. When attackers can pivot through provider links, management services, and router control planes, the practical boundary of IAM extends far beyond human logins. That means security teams should think in terms of governed access paths, not just user accounts, and align network operations with identity governance.

Standing trust relationships create a privileged-access exposure window that attackers can convert into persistence. ACL modifications, AAA redirection, and service enablement show that compromise is not limited to exploiting a bug once. It can also mean reshaping the environment so the attacker keeps inheriting legitimacy. The control gap is not only patching, but lifecycle control over privileged network access and administrative reach.

Configuration drift on routers and AAA systems is a form of identity drift. When device state diverges from approved baselines, attackers can hide inside approved pathways while changing how authentication and routing behave. This is where NIST CSF, NIST SP 800-53, and identity governance intersect in practice: the enterprise needs one view of who can alter trust, who can consume it, and how quickly that trust can be revoked.

High-value network devices should be governed like non-human identities. A router, tunnel endpoint, or TACACS+ server can authenticate, authorize, and move data with more reach than many human users. That makes infrastructure trust sprawl: the uncontrolled accumulation of device-level privileges, interconnects, and exceptions that attackers can reuse for persistence and exfiltration. Practitioners should treat that sprawl as a board-level resilience issue, not an operational nuisance.

The advisory validates a broader market shift toward continuous control validation. Defensive teams can no longer rely on static baselines or periodic audits when state actors are actively modifying management planes and hiding inside legitimate traffic patterns. For identity and security programmes, this accelerates demand for controls that connect asset telemetry, privileged access review, and behavioural detection into one governance loop.

From our research:

• 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
• Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities.
• For a broader view of lifecycle and governance failure modes, see The 52 NHI breaches Report.

What this signals

Infrastructure trust is now part of identity governance, because attacker control of routers and AAA systems can outlive the initial exploit. Programmes that separate network change control from access governance will miss the real failure mode, which is trust persistence. The operational answer is to align privileged access review with configuration drift detection and device-level telemetry, not to wait for periodic audits. For standards alignment, compare your controls with NIST Cybersecurity Framework 2.0 and the NIST SP 800-53 Rev 5 Security and Privacy Controls.

Network devices with administrative reach behave like high-value non-human identities. Once that is acknowledged, the programme design changes: treat router accounts, tunnel endpoints, and AAA systems as governed identities with owners, review cycles, and revocation paths. That shift creates a common language between IAM, PAM, and network security, which is where many enterprises still lack operating maturity.

Control validation has to be continuous when attackers can rewrite the trusted path itself. Teams should assume that any stale exception, unmanaged service, or unreviewed interconnect can become an access path. The most useful next step is to fold these assets into identity inventory, privileged access review, and response playbooks so the organisation can reduce blast radius before an intrusion becomes surveillance infrastructure.

For practitioners

• Inventory privileged network trust paths Map every provider-to-provider, provider-to-customer, and management-plane connection that can alter routing, authentication, or logging. Classify each path by blast radius, and require an owner for revoke authority across network and identity teams.
• Treat ACL and AAA changes as high-risk identity events Alert on changes to ACLs, TACACS+, RADIUS, SNMP, SSH, and HTTP(S) management settings with the same urgency as privileged IAM changes. Correlate them with admin sessions, change tickets, and device telemetry before allowing the change to stand.
• Remove standing access from non-essential device services Disable Guest Shell, legacy management ports, and any remote service that is not required for operations. Where a service must remain, constrain it to approved source ranges and verify that logging exits the management VRF.
• Validate router baselines and routing integrity continuously Pull running configurations at a fixed cadence and compare them with approved baselines for ACLs, routes, tunnel settings, and service states. Investigate any unexplained drift before returning the device to normal trust status.
• Use attack simulation to test control-plane detection Exercise detection logic for exploitation attempts, tunnel creation, authentication redirection, and configuration manipulation across core network devices. Pair those tests with tabletop review of who can approve emergency changes.

Key takeaways

• PRC espionage campaigns are succeeding partly because trusted network infrastructure can be turned into a durable access mechanism.
• The strongest evidence in the advisory is not just exploitation, but the reuse of authentication flows, ACL changes, and tunnels to sustain collection and exfiltration.
• Practitioners should govern routers, AAA systems, and interconnects as privileged access assets so control-plane abuse is detected and revoked faster.

Key terms

• Trusted Interconnection: A trusted interconnection is a network path that is allowed to carry administrative or operational traffic because both sides assume the other is legitimate. In practice, these links can become attack highways if their access rules, monitoring, and revocation process are not governed like privileged identity.
• Control Plane: The control plane is the set of actions that create, configure, or manage a service. For AI workloads, it covers deployment and administration of the model platform, while data-plane permissions govern what the service and its identities can read or process.
• AAA Infrastructure: AAA stands for authentication, authorization, and accounting. AAA infrastructure decides who can log in, what they can do, and how their actions are recorded. If it is modified by an attacker, the organisation may lose both access control and trustworthy evidence at the same time.
• Configuration Drift: Configuration drift is the gradual divergence between a system's intended secure state and the settings it actually runs with over time. In SaaS, drift often appears when admins change sharing, logging, or access controls under pressure and never return to validate the result.

What's in the full article

SafeBreach's full analysis covers the operational detail this post intentionally leaves for the source:

• Exact CISA advisory mappings for the actor set, CVEs, and MITRE ATT&CK techniques used in the campaign
• SafeBreach simulation coverage for router exploitation, credential theft, lateral movement, and covert exfiltration
• Defensive checks for Guest Shell abuse, non-standard management ports, and suspicious AAA redirection
• Attack-series validation steps for teams that need to test detections against the advisory's TTPs

👉 The full SafeBreach post covers the attack chain, simulations, and mitigation steps in more operational detail.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management for practitioners building stronger access control. It gives identity and security teams a shared foundation for governing privileged systems and non-human access.