This is your Cyber Sentinel: Beijing Watch podcast.

Hey listeners, Ting here—your insider on all things China, cyber, and hacking, reporting to you from the digital trenches. Forget small talk; we’re diving straight into Beijing Watch: Cyber Sentinel’s rundown for the week ending September 29, 2025. Buckle your seatbelts—this ride is pure zero-day adrenaline.

Chinese cyber operators have moved from subtle probes to high-impact campaigns, with the biggest tremor shaking the US coming from the so-called ArcaneDoor group. According to Cisco, these folks exploited not one but two fresh zero-day vulnerabilities—CVE-2025-20333 and CVE-2025-20362—in Cisco ASA and Secure Firewall Threat Defense gear. What’s wild is they went beyond just snooping; they gained root access, disabled security logs, intercepted CLI commands, and even crashed devices to foil forensic teams. When you can brick firewalls remotely and keep your backdoors after reboots and patches, you’ve leveled up from script kiddie to nation-state juggernaut.

The U.S. CISA, led by Chris Butera, just dropped an emergency fix order—meaning hundreds of federal agencies are urgently hunting for compromised firewalls. But this isn’t just a government headache; CISA and Cisco both warn private sector and other governments to get patching. Across the pond, the UK’s National Cyber Security Centre confirmed the same code implants are popping up in critical infrastructure, hinting at an international pre-positioning phase. Translation: Chinese state actors are digging foxholes across Western networks for potential future data exfiltration or even disruptive sabotage—not just information theft.

Which industries are the top targets right now? Telecom remains ground zero. Cisco Talos has tracked the Naikon threat group targeting Asian telcos and manufacturers since 2022, but after months lurking in Central and South Asia, attackers have pivoted westward. Naikon, using their signature PlugX and RainyDay backdoors, abuses legitimate applications with DLL sideloading and advanced XOR-RC4-RtlDecompressBuffer encryption. If you build or operate communications networks, your supply chain has a bullseye on it—and utilities are especially vulnerable thanks to embedded modules and lax vendor vetting. The latest Department of Defense memo expands oversight to include Chinese cellular modem suppliers for IoT and utility systems, which means a regulatory crackdown is coming.

Attribution-wise, most signals still point toward Chinese state-sponsored actors, often blending tools and infrastructure among overlapping teams like BackdoorDiplomacy and Naikon. The evidence? Identical malware loaders, RC4 keys reused, and overlapping payloads picked up in unrelated incidents. So, if you see PlugX, RainyDay, or Turian cropping up in a breach report, it’s not just copycats—it’s persistent adversaries swapping parts from the same toolbox.

The international response? For starters, the US just denied DJI’s attempt to ditch its

This content was created in partnership and with the help of Artificial Intelligence AI.