CERT-CN

CERT-CN

CERT-CN is a national computer emergency response team based in Beijing that coordinates cybersecurity incident handling, vulnerability response, and network defense activities within the People's Republic of China. It operates alongside other national and provincial technical teams to monitor threats, issue advisories, and provide incident response for state agencies, corporations, and critical infrastructure operators. The team interacts with domestic entities and international counterparts to share indicators, coordinate mitigation, and support law enforcement and regulatory actions.

History

CERT-CN emerged during a period of rapid internet adoption in China in the late 1990s and early 2000s, influenced by the creation of early Computer Emergency Response Teams such as the CERT Coordination Center, US-CERT, and regional counterparts like JPCERT/CC and AusCERT. Its formation responded to high-profile incidents linked to worms, distributed denial-of-service attacks, and intrusions that affected providers and financial institutions including China Telecom, Industrial and Commercial Bank of China, and early telecommunication backbones. Over time CERT-CN adapted to shifts in the threat landscape exemplified by campaigns attributed to advanced groups in incidents reminiscent of cases involving Equation Group, APT28, APT10, and Lazarus Group, while also addressing opportunistic malware families such as Conficker, WannaCry, and NotPetya. Policy and legal developments in the country, paralleling measures like the Cybersecurity Law of the People's Republic of China and regulatory frameworks seen internationally in instruments such as the General Data Protection Regulation, shaped CERT-CN’s mandate and operational procedures. High-visibility events including national tendering for cybersecurity resources, major breaches at state-owned enterprises, and the need to secure major events—akin to preparations for the Beijing Olympics—further accelerated its institutional growth.

Organization and Governance

CERT-CN functions within a broader institutional ecosystem that includes national agencies and sectoral regulators comparable to relationships between United States Department of Homeland Security components and national CERT bodies in countries like Japan and United Kingdom. Its governance model aligns with practices seen at organizations such as FIRST and national teams like CERT-EU, integrating technical steering, policy liaison, and incident response units. Leadership roles coordinate with ministries and state organs, similar to interagency links observed between National Security Agency advisory structures and civil agencies in other states. The team maintains internal divisions for vulnerability handling, situational awareness, forensic analysis, and public advisories, mirroring structures at Kaspersky Lab, Symantec, Trend Micro, and research units like Mandiant and FireEye. Committees and working groups facilitate compliance with national standards comparable to GB/T and international standards such as ISO/IEC 27001 and NIST Cybersecurity Framework implementations, while also interfacing with major internet infrastructure operators including China Mobile, China Unicom, and cloud providers like Alibaba Cloud and Tencent Cloud.

Responsibilities and Services

CERT-CN’s responsibilities encompass incident detection, analysis, coordination of mitigation, and dissemination of technical advisories, functions similar to those performed by SANS Institute-affiliated teams and commercial responders like CrowdStrike. Services include vulnerability disclosure coordination following models used by MITRE's Common Vulnerabilities and Exposures process, issuing indicators of compromise that parallel reporting by VirusTotal and public advisories akin to bulletins from Microsoft Security Response Center and Cisco Talos. CERT-CN provides situational awareness feeds, early warning for large-scale threats comparable to notices from Shadowserver Foundation, and technical support for incident response in sectors such as banking, telecommunications, and energy—sectors represented by entities like State Grid Corporation of China and Bank of China. It conducts threat intelligence analysis, malware reverse engineering, and forensics using toolchains similar to those developed by Volatility Foundation, Wireshark, and REvil-targeting toolsets. Training, exercises, and capacity building reflect curricula and simulation practices found in programs by ENISA and national CERTs such as US-CERT.

Notable Incidents and Responses

CERT-CN has engaged in responses to incidents that affected major institutions and national infrastructure, comparable in scale to responses to attacks on Sony Pictures Entertainment and compromises linked to SolarWinds. It has issued advisories during outbreaks of ransomware and supply-chain compromises reminiscent of NotPetya and ShadowHammer, coordinated remediation for vulnerabilities affecting widely used products from vendors like Microsoft, Adobe Systems, Oracle, and Huawei, and provided guidance during high-impact intrusions attributed to sophisticated actors similar to APT1 and APT3. In some instances its advisories and takedowns intersected with actions by large platform operators such as Baidu, Weibo, Apple, and Google and with cross-border investigations that involved counterparts like Europol, Interpol, and bilateral teams including US-CERT and JPCERT/CC. Publicized responses to large-scale botnet disruptions and zero-day exploitation mirrored collaborative takedowns led by coalitions like those coordinated around Operation Tovar.

Collaboration and Partnerships

CERT-CN maintains collaborative relationships with domestic technology firms, academic centers, and international CERTs akin to partnerships seen between CERT-EU and national teams, participating in multilateral forums such as FIRST, regional exchanges with APCERT, and information-sharing initiatives comparable to those organized by NATO cybersecurity agencies and APEC dialogues. It engages with commercial security vendors including Qihoo 360, Palo Alto Networks, and Check Point Software Technologies for threat intelligence exchange, joint exercises, and coordinated disclosure. Cooperation extends to law enforcement and judicial bodies, analogous to interactions between FBI cyber units and national response teams elsewhere, and to standard-setting organizations such as IEC and ISO. CERT-CN also contributes to capacity-building through workshops with universities like Tsinghua University and Peking University and participates in incident response drills modeled after exercises run by Cyber Command and civilian-national table-top programs.

Category:Computer emergency response teams