Sign up to save your podcasts
Or
Share Cyber Siege: Chinese Hackers Gone Wild! Ninja Moves, Stolen Billions, and a Global Hacking Frenzy
Share to email
Share to Facebook
Share to X
Share to email
Share to Facebook
Share to X
Or
Cyber Siege: Chinese Hackers Gone Wild! Ninja Moves, Stolen Billions, and a Global Hacking Frenzy
This is your Dragon's Code: America Under Cyber Siege podcast.
Ting here, listeners! Buckle up because the past few days in the cyber trenches have been nothing short of Hollywood-level drama. If you thought last week’s phishing wave was wild, this week, we entered a new chapter: Dragon’s Code—America Under Cyber Siege.
Let’s start with Monday, when reports from Palo Alto Networks and Fortra confirmed what many in Washington had been whispering—Chinese-linked actors have gone beyond headline-grabbing data dumps. This time, it’s all about surgical strikes on US infrastructure. Take the Smishing Triad, for example: since January, these folks have spun up over 194,000 domains, blasting everything from financial brokers to logistics firms with SMS phishing—sending Americans into a spam-induced panic. The payoff? Over $1 billion in stolen credentials and emptied accounts, and this week, they upped the ante by mimicking government disaster alerts, baiting targets into tapping sketchy links and giving up banking codes.
Switching to the back end, Symantec and Trend Micro both confirmed a new attack vector—exploiting the ToolShell vulnerability, a Windows flaw that was patched by Microsoft just two days before Chinese groups like Glowworm and UNC5221 started their scans. Here’s the kicker: they didn’t just smash and grab. They blended in, using legit software like Trend Micro and BitDefender tools to deliver malware—think Zingdoor and KrustyLoader—straight into telecom and energy networks. Pure ninja stuff. The sophistication points to high-level coordination, with Microsoft also fingering Budworm and Storm-2603 as key players. Affected systems include everything from state grids in Texas to water utilities in the Midwest, with forensics showing credential theft and persistent backdoor access.
Now, attribution—it’s always the spicy part. Department of Homeland Security analysts this week rolled out evidence of command-and-control nodes lighting up across Asia, many registered to known Chinese APT infrastructure. Beijing’s Foreign Ministry, fronted by Guo Jiakun, of course doubled back, accusing the NSA and the US of being the “number-one hacking state”—classic pot-calling-the-kettle cyber geopolitics.
The defensive playbook has been frantic but not hopeless. CISA’s John Keller outlined the immediate response: isolating affected segments, rolling out behavioral AI detection to spot ToolShell abuse, and enforcing strict backup credential rotation. Manufacturing took the heaviest hit—61% more ransomware incidents this year, says KELA—so Houston’s refineries and Detroit’s plants are running triple audits on remote access and backup tools. Jacob Santos at Trend Micro stressed the need for continuous monitoring: perimeter security just won’t cut it when the attackers use “BYOVD”—bring your own vulnerable driver—and sneak in through your own antivirus software.
The big lesson this week? The adversary is cross-platform, creative, and ruthless. Prominent analyst Maristel Policarpio warned on Thursday that high-value sectors must expect both ransomware and espionage in one blended op. And for all the policy chatter, the consensus from DC to Silicon Valley is: assume breach, hunt proactively, and don’t trust the traffic—least of all the traffic pretending to be from your own security tools.
Thanks for tuning in—don’t forget to subscribe for your weekly dose of cyber intrigue. This has been a quiet please production, for more check out quiet please dot ai.
For more http://www.quietplease.ai
Get the best deals https://amzn.to/3ODvOta
This content was created in partnership and with the help of Artificial Intelligence AI
Ting here, listeners! Buckle up because the past few days in the cyber trenches have been nothing short of Hollywood-level drama. If you thought last week’s phishing wave was wild, this week, we entered a new chapter: Dragon’s Code—America Under Cyber Siege.
Let’s start with Monday, when reports from Palo Alto Networks and Fortra confirmed what many in Washington had been whispering—Chinese-linked actors have gone beyond headline-grabbing data dumps. This time, it’s all about surgical strikes on US infrastructure. Take the Smishing Triad, for example: since January, these folks have spun up over 194,000 domains, blasting everything from financial brokers to logistics firms with SMS phishing—sending Americans into a spam-induced panic. The payoff? Over $1 billion in stolen credentials and emptied accounts, and this week, they upped the ante by mimicking government disaster alerts, baiting targets into tapping sketchy links and giving up banking codes.
Switching to the back end, Symantec and Trend Micro both confirmed a new attack vector—exploiting the ToolShell vulnerability, a Windows flaw that was patched by Microsoft just two days before Chinese groups like Glowworm and UNC5221 started their scans. Here’s the kicker: they didn’t just smash and grab. They blended in, using legit software like Trend Micro and BitDefender tools to deliver malware—think Zingdoor and KrustyLoader—straight into telecom and energy networks. Pure ninja stuff. The sophistication points to high-level coordination, with Microsoft also fingering Budworm and Storm-2603 as key players. Affected systems include everything from state grids in Texas to water utilities in the Midwest, with forensics showing credential theft and persistent backdoor access.
Now, attribution—it’s always the spicy part. Department of Homeland Security analysts this week rolled out evidence of command-and-control nodes lighting up across Asia, many registered to known Chinese APT infrastructure. Beijing’s Foreign Ministry, fronted by Guo Jiakun, of course doubled back, accusing the NSA and the US of being the “number-one hacking state”—classic pot-calling-the-kettle cyber geopolitics.
The defensive playbook has been frantic but not hopeless. CISA’s John Keller outlined the immediate response: isolating affected segments, rolling out behavioral AI detection to spot ToolShell abuse, and enforcing strict backup credential rotation. Manufacturing took the heaviest hit—61% more ransomware incidents this year, says KELA—so Houston’s refineries and Detroit’s plants are running triple audits on remote access and backup tools. Jacob Santos at Trend Micro stressed the need for continuous monitoring: perimeter security just won’t cut it when the attackers use “BYOVD”—bring your own vulnerable driver—and sneak in through your own antivirus software.
The big lesson this week? The adversary is cross-platform, creative, and ruthless. Prominent analyst Maristel Policarpio warned on Thursday that high-value sectors must expect both ransomware and espionage in one blended op. And for all the policy chatter, the consensus from DC to Silicon Valley is: assume breach, hunt proactively, and don’t trust the traffic—least of all the traffic pretending to be from your own security tools.
Thanks for tuning in—don’t forget to subscribe for your weekly dose of cyber intrigue. This has been a quiet please production, for more check out quiet please dot ai.
For more http://www.quietplease.ai
Get the best deals https://amzn.to/3ODvOta
This content was created in partnership and with the help of Artificial Intelligence AI
View all episodes
By Inception Point AiThis is your Dragon's Code: America Under Cyber Siege podcast.
Ting here, listeners! Buckle up because the past few days in the cyber trenches have been nothing short of Hollywood-level drama. If you thought last week’s phishing wave was wild, this week, we entered a new chapter: Dragon’s Code—America Under Cyber Siege.
Let’s start with Monday, when reports from Palo Alto Networks and Fortra confirmed what many in Washington had been whispering—Chinese-linked actors have gone beyond headline-grabbing data dumps. This time, it’s all about surgical strikes on US infrastructure. Take the Smishing Triad, for example: since January, these folks have spun up over 194,000 domains, blasting everything from financial brokers to logistics firms with SMS phishing—sending Americans into a spam-induced panic. The payoff? Over $1 billion in stolen credentials and emptied accounts, and this week, they upped the ante by mimicking government disaster alerts, baiting targets into tapping sketchy links and giving up banking codes.
Switching to the back end, Symantec and Trend Micro both confirmed a new attack vector—exploiting the ToolShell vulnerability, a Windows flaw that was patched by Microsoft just two days before Chinese groups like Glowworm and UNC5221 started their scans. Here’s the kicker: they didn’t just smash and grab. They blended in, using legit software like Trend Micro and BitDefender tools to deliver malware—think Zingdoor and KrustyLoader—straight into telecom and energy networks. Pure ninja stuff. The sophistication points to high-level coordination, with Microsoft also fingering Budworm and Storm-2603 as key players. Affected systems include everything from state grids in Texas to water utilities in the Midwest, with forensics showing credential theft and persistent backdoor access.
Now, attribution—it’s always the spicy part. Department of Homeland Security analysts this week rolled out evidence of command-and-control nodes lighting up across Asia, many registered to known Chinese APT infrastructure. Beijing’s Foreign Ministry, fronted by Guo Jiakun, of course doubled back, accusing the NSA and the US of being the “number-one hacking state”—classic pot-calling-the-kettle cyber geopolitics.
The defensive playbook has been frantic but not hopeless. CISA’s John Keller outlined the immediate response: isolating affected segments, rolling out behavioral AI detection to spot ToolShell abuse, and enforcing strict backup credential rotation. Manufacturing took the heaviest hit—61% more ransomware incidents this year, says KELA—so Houston’s refineries and Detroit’s plants are running triple audits on remote access and backup tools. Jacob Santos at Trend Micro stressed the need for continuous monitoring: perimeter security just won’t cut it when the attackers use “BYOVD”—bring your own vulnerable driver—and sneak in through your own antivirus software.
The big lesson this week? The adversary is cross-platform, creative, and ruthless. Prominent analyst Maristel Policarpio warned on Thursday that high-value sectors must expect both ransomware and espionage in one blended op. And for all the policy chatter, the consensus from DC to Silicon Valley is: assume breach, hunt proactively, and don’t trust the traffic—least of all the traffic pretending to be from your own security tools.
Thanks for tuning in—don’t forget to subscribe for your weekly dose of cyber intrigue. This has been a quiet please production, for more check out quiet please dot ai.
For more http://www.quietplease.ai
Get the best deals https://amzn.to/3ODvOta
This content was created in partnership and with the help of Artificial Intelligence AI
Ting here, listeners! Buckle up because the past few days in the cyber trenches have been nothing short of Hollywood-level drama. If you thought last week’s phishing wave was wild, this week, we entered a new chapter: Dragon’s Code—America Under Cyber Siege.
Let’s start with Monday, when reports from Palo Alto Networks and Fortra confirmed what many in Washington had been whispering—Chinese-linked actors have gone beyond headline-grabbing data dumps. This time, it’s all about surgical strikes on US infrastructure. Take the Smishing Triad, for example: since January, these folks have spun up over 194,000 domains, blasting everything from financial brokers to logistics firms with SMS phishing—sending Americans into a spam-induced panic. The payoff? Over $1 billion in stolen credentials and emptied accounts, and this week, they upped the ante by mimicking government disaster alerts, baiting targets into tapping sketchy links and giving up banking codes.
Switching to the back end, Symantec and Trend Micro both confirmed a new attack vector—exploiting the ToolShell vulnerability, a Windows flaw that was patched by Microsoft just two days before Chinese groups like Glowworm and UNC5221 started their scans. Here’s the kicker: they didn’t just smash and grab. They blended in, using legit software like Trend Micro and BitDefender tools to deliver malware—think Zingdoor and KrustyLoader—straight into telecom and energy networks. Pure ninja stuff. The sophistication points to high-level coordination, with Microsoft also fingering Budworm and Storm-2603 as key players. Affected systems include everything from state grids in Texas to water utilities in the Midwest, with forensics showing credential theft and persistent backdoor access.
Now, attribution—it’s always the spicy part. Department of Homeland Security analysts this week rolled out evidence of command-and-control nodes lighting up across Asia, many registered to known Chinese APT infrastructure. Beijing’s Foreign Ministry, fronted by Guo Jiakun, of course doubled back, accusing the NSA and the US of being the “number-one hacking state”—classic pot-calling-the-kettle cyber geopolitics.
The defensive playbook has been frantic but not hopeless. CISA’s John Keller outlined the immediate response: isolating affected segments, rolling out behavioral AI detection to spot ToolShell abuse, and enforcing strict backup credential rotation. Manufacturing took the heaviest hit—61% more ransomware incidents this year, says KELA—so Houston’s refineries and Detroit’s plants are running triple audits on remote access and backup tools. Jacob Santos at Trend Micro stressed the need for continuous monitoring: perimeter security just won’t cut it when the attackers use “BYOVD”—bring your own vulnerable driver—and sneak in through your own antivirus software.
The big lesson this week? The adversary is cross-platform, creative, and ruthless. Prominent analyst Maristel Policarpio warned on Thursday that high-value sectors must expect both ransomware and espionage in one blended op. And for all the policy chatter, the consensus from DC to Silicon Valley is: assume breach, hunt proactively, and don’t trust the traffic—least of all the traffic pretending to be from your own security tools.
Thanks for tuning in—don’t forget to subscribe for your weekly dose of cyber intrigue. This has been a quiet please production, for more check out quiet please dot ai.
For more http://www.quietplease.ai
Get the best deals https://amzn.to/3ODvOta
This content was created in partnership and with the help of Artificial Intelligence AI