Zangge Mining Successfully Completes Defensive Tasks in the “Network Protection 2026” Cybersecurity Attack-and-Defense Exercise

       Recently, Zangge Mining participated as a member of the blue team (defenders) in the “Network Protection 2026” Cybersecurity Attack-and-Defense Exercise, jointly organized by the Qinghai Provincial Public Security Department and the Office of the Cyberspace Affairs Commission of the CPC Qinghai Provincial Committee. The exercise lasted 14 days, beginning on September 7. Facing extensive, high-frequency, and unpredictable cyberattacks launched by the red team (attackers), the Company implemented comprehensive preparations and targeted defensive measures, successfully completing all assigned defensive tasks. The exercise provided a practical assessment of the Company’s overall cybersecurity protection capabilities.

       Thorough Preparation to Meet the Challenge. Upon receiving the official notification to participate, the Company’s Information Management Department promptly took the lead in establishing a dedicated project team, defining the command structure and assigning responsibilities. Internally, the department issued three special notices to coordinate the communication and implementation of relevant policies and requirements. It also organized cybersecurity training for all current employees, covering information security knowledge and real-world case studies. These efforts aimed to integrate security requirements into daily operations and ensure that employees translated cybersecurity awareness into practical action. Externally, the Company promptly coordinated with its partners to secure technical support, bringing together internal and external resources to meet the challenge.

       Strengthening Multi-Layered Cybersecurity Defenses. The Company adopted a defensive strategy emphasizing perimeter security in the cloud and personnel security in the workplace. Under the overall coordination of the leadership team, the project team established an integrated prevention and control framework covering four dimensions: coordination with higher-level authorities, internal departments, external partners, and subordinate units. At the cloud level, the Company comprehensively strengthened Alibaba Cloud security components and implemented strict access controls and virtual patching. At the on-premises level, an Advanced Persistent Threat (APT) early-warning platform was deployed to enable comprehensive network traffic monitoring and automatic blocking of malicious activities. Together, these measures established a five-layer defense-in-depth system encompassing cloud security, network perimeter security, office network security, endpoint and account security, and personnel security.

       Demonstrating Effective Closed-Loop Incident Response. The implementation team established a six-stage closed-loop response mechanism comprising monitoring and detection, analysis and assessment, emergency response, threat eradication and recovery, incident tracing and reporting, and post-incident review and improvement. During the exercise, the team effectively addressed several types of cyberattacks. Scanning attacks targeting system platforms were blocked through IP blacklisting. In response to large-scale vulnerability scanning, malicious IP addresses were precisely identified and blocked to prevent lateral movement. When attacks exploited weak passwords associated with firewall vulnerabilities, the team blocked the attacks, disabled the affected VPN accounts, and remediated the weak passwords. All incidents were handled through the established closed-loop response process.

       Driving Continuous Improvement Through Comprehensive Review. On September 22, the Information Management Department organized a post-exercise review meeting to comprehensively evaluate the strengths and weaknesses identified throughout the defensive operations. The department compiled lists of identified issues and lessons learned, established a rectification tracking register, and implemented item-by-item follow-up and closure procedures to ensure that corrective actions were effectively completed.

       Building on the experience gained from this exercise, the Information Management Department will incorporate proven defensive practices into its routine cybersecurity management mechanisms and prioritize improvements in areas where vulnerabilities and weaknesses were identified. Through these efforts, the Company will continue to strengthen its cybersecurity defenses and provide robust cybersecurity safeguards for its high-quality development.