Like many other websites that I love to read the Articles they share via RSS, the cisa.gov is one of them. Since I have thousend of sites in my list, sometimes I read articles that are a bit old, like this one that is from 25 August of this present year. It looks like China, the oldest contry in the old that have a history of compulsive wars, is growing his power, by attacking world wide Govermental services and other Private industries, to control the world. I am not surprised, since that is how the "Dragon", develop everything he is, while I must admite that I am surprised that the technique used is something "peaceful", like all cyber attacks can be, since they don't touch any other living being in a violent and physic way, but manipulate leters, numbers and symbols in a logic way. Since AI in China is growing super fast as it is growing everywhere else (that are not stoped in Time) I see this "path" different from all others in History. The Virtue of Logic and Imagination, that was, is and will be forever, the unique way to "walk the path" on any objective in life.
I really like this article with the name: Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System'. Long title as Long as Dragons: (may I notice you that the sound of the word (long) in Chinese, means Dragon). Anyway, Anyone can see the report of this event in PDF, which is not so Big. If you ever been in a HackerFest, you know that Chinese and Japanese are the Best! (they develop their skills based on their Cultural abilities that are absolute (OCPP: Obcessive Compulsive Paranoid with Perfeccionism)). It is a line that define the Dragon on the Top, while for many centuries was only Kung Fu, these days is everything else, like we may see in China, how perfect some cities are designed and planed, before they start to build it. Is like their Kung Fu training. They pass several years practicing small details in a compulsive way, and when you see some of their moves you question: "wow, is that possible?" ( it is, if you practice in a Compulsive Obcessive style focusing Perfeccionism which require Big Self Discipline )
Anyway, this article is really extensive and like many of our actual problems in society, is that the Goverments only see the problem when they are the target (not the civilian that owns no business, but it is already victim of what Companies will be ). It looks like Cisco is one of the main targets of these APT groups, and naturally, using any minimal Virtual system like Docker or LXC, is for simplicity a good choice, while monitoring their activity is not something that normal people do.
For the perspective of Privacy, changing the default ports of services is a way to trick and filter non-authorized connections, mainly in the actual days, where the internet is full of bots scanning all devices that are connected with automated attacks attempts, to get the people that think that the internet is a secure world, while is a bit worst than the streets. Even then, Linux is as well, part of the targets since is getting popularity and most users don't configure their systems to be secure. Is like that FALSE idea that Linux is secure, which is True that is secure, if you configure it to be secure, while it is secure by default, since normally there is no Open-Services running on every Linux box by default. I remember to see developers building servers without using SSL when building a login system, without configuring IPTables and some of them, opening extra ports on routers, just to follow the defaut settings that they use to develop an application, like for example to create a reverse-proxy. You don't need to open an extra port. You need to RTFM!!!!
If you like to dive into the technical theories, search for this article and read it by yourself. I am just adding some comments about it. The cool thing on this article is that they provide a big list of IPs that you should add them to the Black-List to prevent new attacks from them. They also provide with several recommendations to restrict Loggin systems, and any other service that "you", are running as a public service. This is why I like to read this and other articles, since they give you instructions or some tips, to help you in your choice. If you like, READ the CVEs that are behind each vulnerability to better understand how this crazy attacks happen.
Is always about MEMORY, since we are Memory and All living beings have some Memory 'pre-installed'