Dragon's Code: America Under Cyber Siege

This is your Dragon's Code: America Under Cyber Siege podcast.

Hello listeners, Ting here—your favorite cyber sleuth with a penchant for microwave noodles and digital fortress breaches! If you thought America’s infrastructure had a sleepy week, let me jolt you awake with Dragon’s Code: America Under Cyber Siege, covering the most sophisticated cyber ops launched by China in the last few days.

Let’s jump into the mayhem—starting with the US National Nuclear Security Administration. Yes, the agency handling America’s nuclear arsenal! Last month, Chinese state-backed hackers managed to slip into their networks, exploiting mismanaged passwords, unrestricted remote access, and weak IT/OT segmentation. The attack methodology was classic reconnaissance and privilege escalation, according to US security advisors, followed by credential harvesting via malware and lateral movement across network zones. It’s the kind of playbook the NSA’s digital defense team literally has nightmares about.

Over in the Microsoft ecosystem—which, if you listen to Roger Cressey, ex-White House cyber and counter-terrorism advisor, is practically Beijing’s playground—the plot thickens. Two major vulnerabilities were exposed in Microsoft’s SharePoint and Exchange server platforms. While the SharePoint zero-day is actively exploited, with malware dissected by CISA revealing credential theft tools and remote code execution modules, the fresh Exchange bug (a favorite for Chinese and Russian espionage) has put federal court systems, military supply chains, and infrastructure operators on red alert.

Why is Microsoft such a juicy target? Roger Cressey calls it “a $4 trillion monster”—because US government networks, critical infrastructure, and the military are saturated with its products. Chinese teams are so familiar with these wares, it’s like letting pandas roam the bamboo forest. Senator Tom Cotton literally fired off a letter to SecDef Pete Hegseth, grilling Microsoft about Chinese engineers maintaining US military cloud systems. Turns out, “digital escorts” meant to supervise these foreign techies often lack the skills to spot subtle sabotage.

Let’s talk attribution—it’s no longer digital fingerprints alone. According to the Department of Justice, Cadence Design Systems, led by Lip-Bu Tan, transferred sensitive chipmaking tech to China’s National University of Defense Technology (linked to the PLA), a classic supply chain compromise. Cotton says the evidence is now overwhelming: China is the biggest cyber threat to US infrastructure, with infiltration campaigns targeting everything from defense contractors to telecom networks.

Defensive measures? It’s catch-up mode. Following CISA’s advisory, agencies are rushing to encrypt credentials, deploy multi-factor authentication, and audit admin accounts. The FAA and TSA just pushed new cybersecurity standards for unmanned traffic systems, requiring NIST-based policies and continuous threat assessment—think zero trust, secure-by-d

This content was created in partnership and with the help of Artificial Intelligence AI.

This is your Dragon's Code: America Under Cyber Siege podcast.

If you’ve patched anything this week, bless your keyboard—let’s get into Dragon’s Code: America Under Cyber Siege, the week when Chinese nation-state hackers weren’t just knocking on the door; they tried to reroute the wiring.

First up: SharePoint’s China Syndrome. Remember when Microsoft cops got wise to their codebase being maintained by China-based coders? That bit them—twice. The infamous zero-days CVE-2025-49706 and its merry band (including the 9.8-rated CVE-2025-53770) went from secret to scorched earth before the scheduled patch could even debut. Microsoft’s quick fix July 8th was tripped up and bypassed in hours, with Linen Typhoon and Violet Typhoon—yes, actual Chinese APTs, not X-Men knockoffs—leading the exploitation and Storm-2603 launching Warlock ransomware. The Office of the Director of National Intelligence is on repeat: China is the “most active and persistent cyber threat” we have, and this week proved it. US officials are now considering bans on China-based engineers for anything with even a hint of military tang.

Meanwhile, Darktrace tracked a wild escalation in sophisticated attacks on US infrastructure. Before a nasty flaw in Trimble Cityworks, a platform running everything from airports to water systems, was public knowledge, Chinese-speaking groups were already inside, acting on intel just as suspicious activity was detected in January. They went hands-on-keyboard, exploiting before anyone else even knew to blink. The cyber kill chain included classic spear-phishing, info stealers, and phishing campaigns morphing overnight. According to security experts there, the threat actors’ hallmark was exploiting internet-facing services critical to municipal infrastructure—a risky game when those platforms touch everything from city lights to public works.

And then, say hello to a wholly new flavor of attack—AI-enabled information ops. OODAloop reports that China, with help from rising AI firms, is now using artificial intelligence for all-out information warfare. Not just reading public debate but swarming it, collecting—yes, scraping—data on Members of Congress, then mass-producing propaganda. It's like a thought polisher on steroids, and American intelligence is on edge that these tools could flip from Hong Kong and Taiwan tests to US election meddling in a blink.

We’ve also got face-palming smishing breakthroughs: GBHackers warns about syndicates like Lao Wang’s, using phishing-as-a-service to hijack 115 million US payment cards, provisioning them in Apple Pay and Google Wallet for attack patterns that make old-school bank fraud look quaint. These kits are geofenced, phone-user-aware, and OTP-hungry—they evade Tor and catch real-time codes to own wallets without tripping fraud wires.

Elsewhere, Gladstone AI’s report, referenced by War on the Rocks, flagged Chinese-made hardware baked into American AI data centers, making even the most advanced models vulnerabl

This content was created in partnership and with the help of Artificial Intelligence AI.

This is your Dragon's Code: America Under Cyber Siege podcast.

Ting here, and I hope your firewalls are tougher than last night’s espresso—because this week in Dragon’s Code: America Under Cyber Siege, Chinese state-backed hackers aren’t just knocking on America’s digital doors—they’re picking locks, stuffing the doorjamb with malware, and leaving the alarm system speaking Mandarin.

Let’s dig straight into what happened. The most headline-grabbing operation was the series of attacks attributed to Salt Typhoon, the Chinese cyber group that exploited backdoors in US telecommunications networks. They didn’t just intercept texts and calls; according to Dr. Susan Landau at Tufts and testimony before Congress, Salt Typhoon cracked into the wiretap target lists themselves. So now Beijing knows not only who America is watching, but which of their own operatives got burned—basically a Kim Philby-level fiasco, except it’s played out in real time, on fiber optics instead of typewriters.

The attack methods? Sophisticated supply chain infiltration that took advantage of legal requirements built into the Communications Assistance for Law Enforcement Act, which mandates wiretap capabilities in switches and routers. In trying to help the FBI catch domestic criminals, America handed China a skeleton key to monitor anything—and anyone—moving across the most sensitive telecom arteries. That’s not an accidental security hole; that’s a front-row seat to US counterintel.

Elsewhere, the chaos parade continued with discoveries of malicious remote-trigger codes buried in Chinese-made equipment—power inverters, batteries, electric vehicle chargers—you name it, all according to cybersecurity watchdog Arnie Bellini. Some of these codes function like killswitches. If China feels threatened or just wants to flex, lights out—on pipelines, electric grids, even water systems. Surveillance cameras, transformers, even the stuff keeping your fridge cold could become instant moles if triggered.

And if you think this only affects hardware, think again. Strider Technologies just released a report that Chinese hackers have subtly slipped backdoors into open-source software used by untold American businesses and agencies. They’re not brute-forcing the gate—they’re volunteering at the front desk, waiting for an all-access badge from unsuspecting project maintainers.

Now, the US government isn’t sitting idle. In the face of Salt Typhoon, four of the Five Eyes intelligence powers issued joint guidance: everyone, even the FBI, pushed for end-to-end encryption. That’s something the Bureau has resisted for decades, so you know the risk calculus has changed. Meanwhile, the CSIS just launched a blue-ribbon Commission on Cyber Force Generation to professionalize cyber defense and move from improvisation to readiness.

So, what’s the lesson? First, don’t trust “secure” products built by adversaries. Second, supply chain and legislative convenience can invite disaster. Third, you need world-

This content was created in partnership and with the help of Artificial Intelligence AI.

This is your Dragon's Code: America Under Cyber Siege podcast.

Listeners, buckle up—Ting here, your favorite China cyber whisperer, bringing you this week’s sizzling-hot episode of Dragon’s Code: America Under Cyber Siege. The past few days have been a barrage of sophisticated cyber ops, with China-linked groups leveling their sights on key U.S. systems—and some of the tactics are so clever they’d make Confucius blush.

Let’s dive in where the digital dragon struck hardest: California. According to a jaw-dropping security report, a single water utility faced an onslaught of over 6 million hits from China-based IPs in one week. Six million! Security analysts from companies like Mandiant warned this isn’t random noise; it’s classic reconnaissance—probing for weak spots in our critical infrastructure. Think quiet digital burglar, but instead of jimmying locks, they’re sniffing out vulnerabilities in water supplies that millions of Americans depend on. Talk about a way to make a splash without ever leaving Beijing!

Next, let’s talk about the compromise of the Army National Guard network in an unnamed U.S. state. According to a Department of Homeland Security memo, suspected Chinese group Salt Typhoon infiltrated the system for months—March through December 2024—carefully collecting data that could eventually be weaponized against networks in other states. And don’t forget Volt Typhoon and Silk Typhoon, whose attack tempo has doubled since 2023. These aren’t just random hackers; these are persistent adversaries, backed with resources and modern techniques like supply-chain compromise and exploiting zero-days before patches even drop.

For methodology, we’re seeing strategic use of chained SharePoint vulnerabilities. Microsoft recently confirmed that Chinese groups like Linen Typhoon and Storm-2603 exploited undisclosed bugs in SharePoint—often a day before official patches were published. This allowed them to breach major U.S. government entities, including the National Nuclear Security Administration and multiple state departments. It didn’t stop there—one group even targeted Saint Paul, Minnesota, shutting down city WiFi and forcing a return to pen-and-paper chaos. The FBI and the National Guard were called in forensically and logistically—seriously, who knew cyber could snap pencils too?

On attribution, U.S. agencies didn’t sugarcoat it. Patterns in code, command-and-control servers traced back to Chinese infrastructure, and the scale of the campaigns all point directly at state-linked actors. Microsoft even took the drastic step of halting use of China-based engineers on Defense Department cloud systems after a bombshell ProPublica report exposed their access.

Defensively, we’re seeing a turbo-charged rollout of multifactor authentication, rapid forensic investigations by federal cyber units, and the widespread isolating of compromised systems—sometimes shutting down whole networks to stop data hemorrhage. Ken Bagnall, CEO of Silent Push, like

This content was created in partnership and with the help of Artificial Intelligence AI.

This is your Dragon's Code: America Under Cyber Siege podcast.

Listeners, hi there, I’m Ting—your favorite cyber detective with a front-row seat to the wildest geopolitical cyberspace drama this week. The big stage? Dragon's Code: America Under Cyber Siege. And wow, what a rollercoaster the past few days have been. Let’s jump right into the breach—just don’t forget your patch updates, people.

So here’s the real tech sizzle: starting last weekend, US infrastructure came under fire from what multiple top analysts, including Jon Clay from Trend Micro, are pretty confident are **Chinese state-backed hacking groups**. Their aim? Strategic compromise, targeting the digital glue of American critical services. Their favorite weapons this week—zero-day exploits in Microsoft’s flagship platforms, which, if you spent last year blissfully offline, are hidden vulnerabilities the vendor doesn’t even know about until, well, everything’s already on fire.

Case in point: Microsoft Exchange and SharePoint, those corporate mainstays, were hammered. According to Microsoft’s own security teams, Chinese threat actors breached nearly 400 organizations—heavy on US government departments—through crafty phishing, privilege escalation, and lateral movement across networks. They pilfered sensitive data by exploiting Exchange zero-days, gaining persistence through web shells and then hopping laterally to other systems. Symantec’s advisory said attackers also used living-off-the-land tactics: using legitimate admin tools to avoid tripping alarms.

The US National Guard even found itself in the crosshairs when attackers lifted network configurations, which could expose physical security plans or response protocols. Cisco Talos called the attack “surgical”—not a smash-and-grab, but a careful, months-long infiltration. Not only emails, but proprietary defense designs and, get this, payroll and contractor lists were among the loot.

How do we know it’s likely Chinese? Attribution is always tricky, but according to Ben Read at Wiz.io, linguistic artifacts in the malware, infrastructure overlaps with past APT41 campaigns, and clockwork-precise operations matching Beijing working hours all pile on the circumstantial evidence. Plus, US Cyber Command intercepted traffic aimed at exfiltrating data to command centers in Hainan and Guangdong.

Now, the White House Incident Response Team and CISA—working with Microsoft—rolled out emergency patches and active threat hunting. They deployed endpoint detection and response across federal systems, hunted for the malicious web shells, and alas, mandatory password resets everywhere sent career bureaucrats into caffeine withdrawal. NSA’s Rob Joyce emphasized the value of segmentation: “Don’t let chatty printers talk to your nuclear command.” Sage words, Rob.

The biggest lesson? Experts like Katie Nickels at Red Canary warn: don’t ever underestimate state actors—they’re patient, resourceful, and increasingly blending criminal tools with nation-

This content was created in partnership and with the help of Artificial Intelligence AI.

This is your Dragon's Code: America Under Cyber Siege podcast.

Imagine waking up in July 2025 to another sunrise over D.C., your favorite datacenter humming nearby, only to realize the Red Dragon has been at work while you slept. I’m Ting—part cyber sleuth, part humorist. Let’s jump right into the digital trenches and untangle Dragon’s Code: America Under Cyber Siege.

Over the past week, Chinese operations reached new heights. Step one: the attack on U.S. municipal infrastructure using a zero-day exploit in Cityworks—yeah, that’s right, attackers leveraged an unknown vulnerability to leapfrog our defenses and slip into local government systems, triggering service outages and data exfiltration campaigns. These are not kids in hoodies; DOJ indictments named Xu Zewei and Zhang Yu, both tied to China’s Ministry of State Security, as the architects behind Silk Typhoon, aka Hafnium—the hacker group infamous since their 2021 Microsoft Exchange rampage. SentinelLabs and other researchers report these groups now wield intrusive tools, even patented technologies that let them recover encrypted data and hijack Apple endpoints. The gear is sophisticated, often blending commercial software acquisition and custom exploit development, blurring the cyber arms race between states and contractors.

The real kicker isn’t just how deep they got—multiple federal agencies and defense sector networks went dark for hours—but the forensic evidence uncovered. Attributed attack code matched samples from Shanghai Firetech and their Chongqing subsidiary, and the TTPs—tactics, techniques, and procedures—echoed past MSS playbooks. Attribution, though, becomes a cyber game of whack-a-mole: these firms rotate staff and sell off tools, obscuring blame and making prosecution almost a myth.

Defenses this week? Think whiplash. CISA’s incident response teams rushed to deploy emergency network segmentation, while critical endpoints had to be physically isolated. But here’s the practical problem: congressional contract freezes recently left our cyber programs underfunded. Marci McCarthy from CISA says they’re “laser-focused” on essentials, but experts like Michael Daniel of the Cyber Threat Alliance warn, losing seasoned cyber responders right as adversaries escalate is like pulling firefighters in peak wildfire season.

Meanwhile, at the heart of the Pentagon drama, there’s fresh outrage after revelations that Microsoft let China-based engineers touch elements of military software code. Senator Tom Cotton’s already demanding heads roll and safeguards strengthen—think zero trust, tighter vetting, and a shakeup to end dependency on one tech giant.

Experts from the Atlantic Council argue we need to get serious about supply chain integrity. That means kicking risky Chinese equipment out of our systems and enforcing strict security on third-party vendors. Plus, the White House’s new “Winning the Race: America’s AI Action Plan” calls for integrating AI-driven cybersecurity tools and for

This content was created in partnership and with the help of Artificial Intelligence AI.

This is your Dragon's Code: America Under Cyber Siege podcast.

Brace yourselves, listeners—Ting here, and Dragon’s Code: America Under Cyber Siege has just been rewritten with the most astonishing plot twists courtesy of the past week’s Chinese cyber operations. Forget stealth bombers—these days, the real action unfolds deep in the cloud, hidden behind virtualization layers, and this week’s adversary leveled up yet again.

Let’s start with the drama that erupted when the US government confirmed hundreds of its Microsoft servers—yes, including those at the Department of Energy and even the nuclear weapons agency—had essentially been commandeered by state-sponsored Chinese actors. Picture it: login events traced back to anomalous Chinese servers, the telltale signs of Salt Typhoon and Volt Typhoon splattered across the logs. The fix? Not so fast. Microsoft admitted, publicly, that there wasn't an immediate patch, leaving a gaping window just wide enough for the attackers to loiter like hackers at an all-you-can-eat exploit buffet. Jen Easterly—the now former chief of CISA—summed it as “everything, everywhere, all at once,” and for good reason. US military issued a blunt advisory: act as if every network is compromised, because, well, it probably is. Andrew Orlowski from The Telegraph nailed the mood: a fatalistic exhaustion, with the cyber guardians now embracing permanent crisis mode.

Now, zoom in: Sygnia’s forensics teams exposed the next-level finesse of the Fire Ant group, those artisans of stealth, living off the land inside US, UK, and global enterprises since early 2025. Their specialty was VMware ESXi and vCenter breaches—think cyber ninjas exploiting tiny cracks in your virtual fortress to stroll right past segmented network defenses. These attackers bypassed fancy endpoint detection, dropped persistent backdoors, even warped around incident responders in real time, morphing toolkits and backdooring key infrastructure with the Medusa rootkit. Oh, and the F5 load balancers? Exploited via the infamous CVE-2022-1388: the attackers tunneled through legitimate pathways, bridging segmented internal networks, harvesting credentials silently. The result? Full-stack compromise. And these attacks are attributed with technical overlap to UNC3886, a group US intelligence is now tracking relentlessly.

Layer on top the heart-thumper of the week: deepfake campaigns using AI so real even DC insiders blinked twice. This summer, a convincing deepfake of Secretary of State Marco Rubio circulated, triggered responses from US Senators, and nearly led to disastrous disclosures. As explained by QiD Security’s Kinny Chan and Pindrop’s Vijay Balasubramaniyan, these synthetic fakes shift tactics from stealing secrets to steering real-world actions—altering voting behavior, impersonating CEOs for corporate infiltration, and undermining trust itself. Lawmakers are racing to regulate; technologists are scrambling to build AI-powered countermeasures.

Meanwhile, som

This content was created in partnership and with the help of Artificial Intelligence AI.

This is your Dragon's Code: America Under Cyber Siege podcast.

It’s Ting, your favorite cyber-sleuth with the lowdown on Dragon’s Code: America Under Cyber Siege! Buckle up, because this week has been a real fireworks show—a bit less Independence Day, a bit more System Independence-Napped Day… except the attackers weren’t from Will Smith’s side of the world. Let me walk you through this digital drama.

Kicking off with the big one—the Chinese government-linked hackers, yes, the same familiar crowd Microsoft calls Linen Typhoon, Violet Typhoon, and Storm-2603, have launched a sophisticated assault focused on vulnerabilities in Microsoft SharePoint. What’s sizzling isn’t just the tech mishap, it’s the target: on July 18th, these actors snuck right into the National Nuclear Security Administration. This is the very agency that keeps tabs on the U.S. nuclear stockpile—not the club you want uninvited guests crashing. Microsoft, red-faced, blamed the breach on previously unknown bugs in SharePoint. These bugs opened the door for tens of thousands of systems, particularly on-premises SharePoint servers not upgraded to Microsoft’s more secure cloud service.

Here’s where it gets spicy—attackers pulled off credential harvesting, nabbing usernames, password hashes, and what are essentially session skeleton keys. With those, they could impersonate legitimate users or hopscotch their way deeper into victim networks. Security researchers at Interesting Engineering pointed out that the attackers had already come up with creative detours even after admins applied Microsoft’s patches, deploying persistent access tactics, user impersonation, and theft of authentication keys. Translation: if patching is a game of whack-a-mole, these moles brought shovels.

Beyond SharePoint, researchers from Sygnia flagged an ongoing China-affiliated campaign named “Fire Ant” that targets virtualized infrastructure, especially on VMware’s ESXi and vCenter. These folks exploited weak points in network segmentation and hypervisor layers—often the blind spots of traditional security—then tunneled through them, planted redundant backdoors, and stuck around like houseguests who refuse to leave. Sygnia’s Yoav Mazor noted that Fire Ant’s specialty is persistence; even after being evicted, they’d sneak back in through clever manipulation of network configs.

Now you’re asking, “Hey Ting, how do we know it’s the Chinese government?” Attribution in cyberspace is always tricky, but Microsoft, Bloomberg, and U.S. authorities all agree the infrastructure, tactics, coding style, and even the timing screamed “state-sponsored.” Add in the sheer scale: over 100 organizations hit, including government agencies, energy companies, healthcare, and academic targets.

Defenses? Microsoft scrambled to release patches, and U.S. agencies rapidly moved to segment impacted systems, rotate credentials, and—here’s the headline—finally ramped up migration to hardened cloud platforms. The Cybersecurity and Infr

This content was created in partnership and with the help of Artificial Intelligence AI.

This is your Dragon's Code: America Under Cyber Siege podcast.

Name’s Ting, cyber-wrangler by trade, disaster-preventer by necessity. Let’s decrypt the dragon’s code from the last whirlwind week of America Under Cyber Siege—because wow, the Great Wall has gone digital, and the party’s just getting started. If you were hoping for a typical script about “malware” and “password123,” buckle up. The Chinese apparatus has gone way, way bigger: think SharePoint exploits, shadowy code in critical infrastructure, and classic cloak-and-dagger in the cloud.

Start with the headline grabber—Chinese nation-state cyber operators, especially Linen Typhoon and Violet Typhoon, blitzed through Microsoft SharePoint servers again. Microsoft’s own blog called out these two for exploiting newly discovered vulnerabilities, dropping ransomware and siphoning credentials before the patch could even finish downloading. Not only did the feds notice, but so did every agency and sysadmin from the Department of Homeland Security to Health and Human Services—places you *definitely* don’t want surprises. Even Defense Intelligence Agency had systems offline on July 22, and the National Institutes of Health took a direct hit. Good news: according to Tricia McLaughlin at CISA, there’s no sign yet of data leaks at the big dogs, but for hours, business stopped dead and alarms went off across federal networks.

Here’s the wild part—proving it was China isn’t all IP addresses and Fred from IT pointing at a map. Microsoft and Sygnia researchers tied these attack signatures to “Fire Ant,” a group known for VMware exploitation, lateral movement, and customized toolsets rivaling top-tier APTs. Forensic analysts tracked minor input errors back to Chinese-language keyboards and time patterns matching business hours in Beijing. The UK’s National Cyber Security Centre and U.S. experts, like Dragos’s Robert M. Lee, are now seeing these exact TTPs—tactics, techniques, procedures—in targeted critical infrastructure attacks.

Now the methodology: China’s groups don’t shout—they slip in via virtualization platforms, leapfrog through network segments, and live undetected beneath the radar of traditional endpoint protections. Firewalls and two-factor authentication? Those are just speed bumps if patching and segmentation aren’t ironclad. The government’s rapid response included emergency CISA alerts, Microsoft hotfixes, and round-the-clock patch deployments—not a moment too soon, considering the attackers’ next trick is dropping ransomware as a smokescreen.

But even old flaws can become this week’s catastrophe. Turns out, Microsoft’s Government Community Cloud had *years* of code serviced by engineers in China—yep, for sensitive but “non-classified” data. ProPublica’s investigation found that these “digital escorts”—U.S.-based supervisors—sometimes lacked the chops to spot sophisticated code injections. Secretary of Defense Pete Hegseth instantly banned foreign engineers from touching Pentagon clou

This content was created in partnership and with the help of Artificial Intelligence AI.

This is your Dragon's Code: America Under Cyber Siege podcast.

I’m Ting, and things got spicy this week in cyberspace—so I hope you’re patched up and ready for the latest chapter of Dragon’s Code: America Under Cyber Siege. Right off the bat, Microsoft confirmed that three state-linked Chinese groups—Linen Typhoon, Violet Typhoon, and Storm-2603—engineered a multi-pronged attack on US infrastructure, capitalizing on zero-day gaps in on-premises Microsoft SharePoint servers. Now, SharePoint, that ubiquitous corporate file-sharing backbone, became a hacker’s dream after the discovery of CVE-2025-53770, a flaw so fresh not even Microsoft knew about it until hackers went to town.

By late last week, Google’s Mandiant team and Cisco both spotted these threat actors pounding away at vulnerable targets. Charles Carmakal, Mandiant’s CTO, explained that the primary attack trick was sending specially crafted requests to SharePoint, triggering the flaw and letting hackers execute their secret code remotely. With that foothold, they swiped credentials and pivoted across internal networks like old-school kung fu masters—except with PowerShell scripts instead of nunchucks.

Among dozens of compromised organizations was the National Nuclear Security Administration, which safeguards America’s nuclear arsenal. Luckily, the NNSA relied heavily on modern Microsoft 365 cloud setups rather than legacy on-prem servers, which limited the potential blast radius—even though an agency spokesperson admitted “minimal impacts,” no classified data breach was reported. Still, Barry Mainz of Forescout cautions that with about 80% of places patching up within a week, the lingering 20% of unpatched, especially at smaller firms, are sitting ducks.

On the attribution front, Microsoft, Google, and the US Cybersecurity and Infrastructure Security Agency (CISA) all pointed the finger squarely at these Chinese APT groups. However, the Chinese Embassy in Washington continues its usual routine: deny and deflect, calling the claims “smears without solid evidence.” Liu Pengyu, their spokesman, insists Beijing opposes all cybercrime—a line as familiar to listeners as a Phishing 101 email.

As for defense, CISA couldn’t have been louder: all federal agencies had until today—yes, July 23—to patch those SharePoint vulnerabilities, specifically the ToolShell chain CVE-2025-49704 and -49706, which allow spoofing and remote code execution. Chris Butera from CISA emphasized that their teams worked hand-in-hand with Microsoft and federal bodies to assess scope and contain fallout, but they’re still tallying up the affected agencies and partners—well over 400, by current count.

Cybersecurity pros like Vaisha Bernard at Eye Security and Kim Zetter, who testified at Congress, remind us that, even fifteen years post-Stuxnet, US critical infrastructure—power grids, water, you name it—remains too exposed. The lesson? Don’t just focus on IT; OT, the operational tech that runs the backbone of civilizati

This content was created in partnership and with the help of Artificial Intelligence AI.