Using CFW to Accurately Trace Private IP Addresses in a NAT Gateway Environment

Background

A smart manufacturing enterprise deployed its R&D system on Huawei Cloud, requiring periodic Internet access via a NAT gateway to update open-source components. A ransomware group hijacked a third-party update source, implanting a highly concealed mining Trojan into a monitoring component. To prevent the threat from spreading, the enterprise security team needs to quickly locate the infected assets and mitigate the risks.

Step 1: Enable Strict Blocking to Enhance Defense

The enterprise security team configures the Intrusion Prevention System (IPS) function in CFW and enables strict interception. It automatically blocks known malicious scans and Trojan reconnections based on fingerprints and behavioral characteristics. The procedure is as follows:

1. Log in to the CFW console.
2. Click in the upper left corner of the management console and select a region or project.
3. (Optional) Switch to another firewall instance. If there are multiple firewall instances, you can select a desired instance from the drop-down list in the upper left corner of the page.
4. In the navigation pane on the left, choose Protection Policies > Attack Defense > Intrusion Prevention.
5. Toggle on Basic Protection. Set Protection Mode to Intercept - strict.
   Figure 1 Intrusion prevention
   

Step 2: Check Real-Time Alarms to Locate the Risk Source

The system sends an SMS notification for the critical alarm to the O&M personnel. Perform the following steps to check logs:

1. In the navigation pane of the CFW console, choose O&M Analysis > Log Query to go to the Attack Event Logs tab. The Internet Border Firewall tab is displayed by default.
2. Locate the following record in the attack event log list.
   Figure 2 Attack event logs
   
   • Source IP Address: 10.1.3.157 (private IP address)
   • Risk level: Critical
   • Attack type: Trojan

Step 3: Perform In-Depth Analysis to Confirm Attack Characteristics

View the log details and analyze the attack payload.

1. On the Attack Event Logs page of the Internet border firewall, click View in the Operation column of the target log.
2. On the log details page, analyze the attack payload.

   The O&M personnel identifies a typical mining pool registration (Login/Submit) protocol signature within the packet fragment. Based on this finding, they determined that the server has been compromised by a mining Trojan and is actively attempting to communicate with an external mining pool.

Step 4: Block the Threat with One Click

To prevent the Trojan from downloading malicious scripts or spreading laterally across the intranet, the O&M personnel contained the threat using the following measures:

1. External isolation: Add the identified malicious external IP address to the CFW blacklist to cut off all its communication with the compromised asset.
2. Internal policy: Tighten the outbound filtering policy to ensure the asset can only access verified, necessary update sources.

For details about how to adjust the protection policies, see Access Control Policy.

Step 5: Perform Closed-Loop Remediation to Disinfect Servers

The security team logs in to the target server using the private IP address (10.1.3.157) provided in the log to perform forensic analysis. After confirming the presence of the hidden Trojan file, the security team immediately removes the file and runs a full scan on other assets within the same network segment. Because CFW has intercepted and accurately located the threat in time, the risk is successfully contained in its early stages.