Chinese state-sponsored hackers are targeting organizations and governments in Afghanistan, Bhutan, India, Nepal, Pakistan and Sri Lanka with a now-patched zero-day vulnerability in Sophos Firewall, according to several different cybersecurity companies. This week, Volexity released a report on CVE-2022-1040 – a Sophos firewall authentication bypass vulnerability patched in March – and said a Chinese APT group they named “Drifting Cloud” was using it to install three open-source malware families, including PupyRAT, Pantegana and Sliver. Sophos published its own report on the activity and told Volexity that it has observed “organizations primarily in the South Asia region” being attacked. Recorded Future’s…