Sign up to save your podcasts
Or
Share China's Hacker Extradited: Silk Typhoon Takedown Sends Shockwaves Through Cyber Underworld
Share to email
Share to Facebook
Share to X
Share to email
Share to Facebook
Share to X
Or
China's Hacker Extradited: Silk Typhoon Takedown Sends Shockwaves Through Cyber Underworld
This is your Dragon's Code: America Under Cyber Siege podcast.
Listeners, it’s Ting here, your favorite China-and-cyber-know-it-all, and I hope you’re ready because this past week has been pure Dragon’s Code: America Under Cyber Siege—no Hollywood CGI required.
Let’s get right to it. The FBI’s international cyber dragnet nailed Zewei Xu, a 33-year-old Chinese hacker tied to the notorious Silk Typhoon—yep, that’s Hafnium for the cyber sleuths out there. Xu got nabbed at Milan’s airport, fresh off a flight from China, thanks to a U.S. warrant and some impressive Italian police work. U.S. authorities allege Silk Typhoon orchestrated huge espionage campaigns: think hacking COVID-19 vaccine research at the University of Texas, mass phishing that swept up thousands of inboxes, and vacuuming up policy secrets and IP from the bowels of government networks. If extradited, Xu’s looking at decades in U.S. prison, and the message is loud—cyber crooks can run, but the world’s gotten smaller for them.
The method of attack? Expert-level spearphishing, zero-day exploits, and weaponized open-source tools, often disguised as “legit” VPNs or productivity apps uploaded to places as trusted as GitHub. One scheme this week: a so-called free VPN actually siphoned browser cookies, social media creds, and even banking logins straight to command servers in China. Meanwhile, the U.S. Department of Justice took down a "bulletproof" hosting provider known for sheltering ransomware and phishing operations—an attack enabler, now missing in action.
Critical infrastructure got plenty of unwanted attention too. Suspected Chinese operatives are believed to have breached email accounts at one of DC’s most powerful law firms, with implications for everything from policy lobbying to energy deals. According to the Atlantic Council’s tech team, these kinds of intrusions make clear that small and medium U.S. businesses remain juicy, soft targets, and our information sharing network needs a serious bandwidth upgrade.
Defensively, agencies moved fast. The Cybersecurity and Infrastructure Security Agency (CISA) added a slew of new vulnerabilities—think Multi-Router Looking Glass, Rails, and Zimbra—to its Known Exploited Vulnerabilities list, forcing emergency patch cycles nationwide. Microsoft’s Patch Tuesday addressed a whopping 130 flaws, with OT/IT teams merging their operations for unified defense. The Secret Service’s operational failures during last summer’s attempt on President Trump (remember that?) became a rallying cry—if your comms and monitoring tech is old, you’re basically opening the door for attackers.
Expert consensus, from folks like former CISA Director Chris Krebs, is that the U.S. needs more threat hunters and red teamers, not less. The GAO and cybersecurity boardrooms are finally talking risk management in plain language, giving CISOs direct accountability over both digital and operational technology. If your board doesn’t have a cyber expert yet, they’re running out of excuses.
Biggest lesson? You can’t treat cyber as just a technical issue—it’s governance, it’s investment, and it’s strategy. And in this new era, every takedown, every arrest, every patch buys a little breathing room, but vigilance never sleeps.
Thanks for tuning in, listeners—be sure to subscribe and pass this on to anyone who still thinks cybersecurity is somebody else’s problem. This has been a quiet please production, for more check out quiet please dot ai.
For more http://www.quietplease.ai
Get the best deals https://amzn.to/3ODvOta
Listeners, it’s Ting here, your favorite China-and-cyber-know-it-all, and I hope you’re ready because this past week has been pure Dragon’s Code: America Under Cyber Siege—no Hollywood CGI required.
Let’s get right to it. The FBI’s international cyber dragnet nailed Zewei Xu, a 33-year-old Chinese hacker tied to the notorious Silk Typhoon—yep, that’s Hafnium for the cyber sleuths out there. Xu got nabbed at Milan’s airport, fresh off a flight from China, thanks to a U.S. warrant and some impressive Italian police work. U.S. authorities allege Silk Typhoon orchestrated huge espionage campaigns: think hacking COVID-19 vaccine research at the University of Texas, mass phishing that swept up thousands of inboxes, and vacuuming up policy secrets and IP from the bowels of government networks. If extradited, Xu’s looking at decades in U.S. prison, and the message is loud—cyber crooks can run, but the world’s gotten smaller for them.
The method of attack? Expert-level spearphishing, zero-day exploits, and weaponized open-source tools, often disguised as “legit” VPNs or productivity apps uploaded to places as trusted as GitHub. One scheme this week: a so-called free VPN actually siphoned browser cookies, social media creds, and even banking logins straight to command servers in China. Meanwhile, the U.S. Department of Justice took down a "bulletproof" hosting provider known for sheltering ransomware and phishing operations—an attack enabler, now missing in action.
Critical infrastructure got plenty of unwanted attention too. Suspected Chinese operatives are believed to have breached email accounts at one of DC’s most powerful law firms, with implications for everything from policy lobbying to energy deals. According to the Atlantic Council’s tech team, these kinds of intrusions make clear that small and medium U.S. businesses remain juicy, soft targets, and our information sharing network needs a serious bandwidth upgrade.
Defensively, agencies moved fast. The Cybersecurity and Infrastructure Security Agency (CISA) added a slew of new vulnerabilities—think Multi-Router Looking Glass, Rails, and Zimbra—to its Known Exploited Vulnerabilities list, forcing emergency patch cycles nationwide. Microsoft’s Patch Tuesday addressed a whopping 130 flaws, with OT/IT teams merging their operations for unified defense. The Secret Service’s operational failures during last summer’s attempt on President Trump (remember that?) became a rallying cry—if your comms and monitoring tech is old, you’re basically opening the door for attackers.
Expert consensus, from folks like former CISA Director Chris Krebs, is that the U.S. needs more threat hunters and red teamers, not less. The GAO and cybersecurity boardrooms are finally talking risk management in plain language, giving CISOs direct accountability over both digital and operational technology. If your board doesn’t have a cyber expert yet, they’re running out of excuses.
Biggest lesson? You can’t treat cyber as just a technical issue—it’s governance, it’s investment, and it’s strategy. And in this new era, every takedown, every arrest, every patch buys a little breathing room, but vigilance never sleeps.
Thanks for tuning in, listeners—be sure to subscribe and pass this on to anyone who still thinks cybersecurity is somebody else’s problem. This has been a quiet please production, for more check out quiet please dot ai.
For more http://www.quietplease.ai
Get the best deals https://amzn.to/3ODvOta
View all episodes
By Quiet. PleaseThis is your Dragon's Code: America Under Cyber Siege podcast.
Listeners, it’s Ting here, your favorite China-and-cyber-know-it-all, and I hope you’re ready because this past week has been pure Dragon’s Code: America Under Cyber Siege—no Hollywood CGI required.
Let’s get right to it. The FBI’s international cyber dragnet nailed Zewei Xu, a 33-year-old Chinese hacker tied to the notorious Silk Typhoon—yep, that’s Hafnium for the cyber sleuths out there. Xu got nabbed at Milan’s airport, fresh off a flight from China, thanks to a U.S. warrant and some impressive Italian police work. U.S. authorities allege Silk Typhoon orchestrated huge espionage campaigns: think hacking COVID-19 vaccine research at the University of Texas, mass phishing that swept up thousands of inboxes, and vacuuming up policy secrets and IP from the bowels of government networks. If extradited, Xu’s looking at decades in U.S. prison, and the message is loud—cyber crooks can run, but the world’s gotten smaller for them.
The method of attack? Expert-level spearphishing, zero-day exploits, and weaponized open-source tools, often disguised as “legit” VPNs or productivity apps uploaded to places as trusted as GitHub. One scheme this week: a so-called free VPN actually siphoned browser cookies, social media creds, and even banking logins straight to command servers in China. Meanwhile, the U.S. Department of Justice took down a "bulletproof" hosting provider known for sheltering ransomware and phishing operations—an attack enabler, now missing in action.
Critical infrastructure got plenty of unwanted attention too. Suspected Chinese operatives are believed to have breached email accounts at one of DC’s most powerful law firms, with implications for everything from policy lobbying to energy deals. According to the Atlantic Council’s tech team, these kinds of intrusions make clear that small and medium U.S. businesses remain juicy, soft targets, and our information sharing network needs a serious bandwidth upgrade.
Defensively, agencies moved fast. The Cybersecurity and Infrastructure Security Agency (CISA) added a slew of new vulnerabilities—think Multi-Router Looking Glass, Rails, and Zimbra—to its Known Exploited Vulnerabilities list, forcing emergency patch cycles nationwide. Microsoft’s Patch Tuesday addressed a whopping 130 flaws, with OT/IT teams merging their operations for unified defense. The Secret Service’s operational failures during last summer’s attempt on President Trump (remember that?) became a rallying cry—if your comms and monitoring tech is old, you’re basically opening the door for attackers.
Expert consensus, from folks like former CISA Director Chris Krebs, is that the U.S. needs more threat hunters and red teamers, not less. The GAO and cybersecurity boardrooms are finally talking risk management in plain language, giving CISOs direct accountability over both digital and operational technology. If your board doesn’t have a cyber expert yet, they’re running out of excuses.
Biggest lesson? You can’t treat cyber as just a technical issue—it’s governance, it’s investment, and it’s strategy. And in this new era, every takedown, every arrest, every patch buys a little breathing room, but vigilance never sleeps.
Thanks for tuning in, listeners—be sure to subscribe and pass this on to anyone who still thinks cybersecurity is somebody else’s problem. This has been a quiet please production, for more check out quiet please dot ai.
For more http://www.quietplease.ai
Get the best deals https://amzn.to/3ODvOta
Listeners, it’s Ting here, your favorite China-and-cyber-know-it-all, and I hope you’re ready because this past week has been pure Dragon’s Code: America Under Cyber Siege—no Hollywood CGI required.
Let’s get right to it. The FBI’s international cyber dragnet nailed Zewei Xu, a 33-year-old Chinese hacker tied to the notorious Silk Typhoon—yep, that’s Hafnium for the cyber sleuths out there. Xu got nabbed at Milan’s airport, fresh off a flight from China, thanks to a U.S. warrant and some impressive Italian police work. U.S. authorities allege Silk Typhoon orchestrated huge espionage campaigns: think hacking COVID-19 vaccine research at the University of Texas, mass phishing that swept up thousands of inboxes, and vacuuming up policy secrets and IP from the bowels of government networks. If extradited, Xu’s looking at decades in U.S. prison, and the message is loud—cyber crooks can run, but the world’s gotten smaller for them.
The method of attack? Expert-level spearphishing, zero-day exploits, and weaponized open-source tools, often disguised as “legit” VPNs or productivity apps uploaded to places as trusted as GitHub. One scheme this week: a so-called free VPN actually siphoned browser cookies, social media creds, and even banking logins straight to command servers in China. Meanwhile, the U.S. Department of Justice took down a "bulletproof" hosting provider known for sheltering ransomware and phishing operations—an attack enabler, now missing in action.
Critical infrastructure got plenty of unwanted attention too. Suspected Chinese operatives are believed to have breached email accounts at one of DC’s most powerful law firms, with implications for everything from policy lobbying to energy deals. According to the Atlantic Council’s tech team, these kinds of intrusions make clear that small and medium U.S. businesses remain juicy, soft targets, and our information sharing network needs a serious bandwidth upgrade.
Defensively, agencies moved fast. The Cybersecurity and Infrastructure Security Agency (CISA) added a slew of new vulnerabilities—think Multi-Router Looking Glass, Rails, and Zimbra—to its Known Exploited Vulnerabilities list, forcing emergency patch cycles nationwide. Microsoft’s Patch Tuesday addressed a whopping 130 flaws, with OT/IT teams merging their operations for unified defense. The Secret Service’s operational failures during last summer’s attempt on President Trump (remember that?) became a rallying cry—if your comms and monitoring tech is old, you’re basically opening the door for attackers.
Expert consensus, from folks like former CISA Director Chris Krebs, is that the U.S. needs more threat hunters and red teamers, not less. The GAO and cybersecurity boardrooms are finally talking risk management in plain language, giving CISOs direct accountability over both digital and operational technology. If your board doesn’t have a cyber expert yet, they’re running out of excuses.
Biggest lesson? You can’t treat cyber as just a technical issue—it’s governance, it’s investment, and it’s strategy. And in this new era, every takedown, every arrest, every patch buys a little breathing room, but vigilance never sleeps.
Thanks for tuning in, listeners—be sure to subscribe and pass this on to anyone who still thinks cybersecurity is somebody else’s problem. This has been a quiet please production, for more check out quiet please dot ai.
For more http://www.quietplease.ai
Get the best deals https://amzn.to/3ODvOta