This is your Dragon's Code: America Under Cyber Siege podcast.
I’m Ting, your favorite China-and-cyber-obsessed nerd, and Dragon’s Code is running hot this week, so let’s dive straight into America Under Cyber Siege.
Over the past few days, US officials and private threat labs from places like Mandiant, CrowdStrike, and Recorded Future have been tracking a surge in Chinese state-linked operations going after the soft underbelly of American infrastructure: power grids, telecom backbone, and transportation control networks. The Department of Homeland Security and CISA briefed Congress that these are not smash-and-grab hacks; they’re meticulous prepositioning for potential disruption in a future crisis.
Listeners, picture a group like Volt Typhoon, the Chinese state-sponsored outfit previously flagged by Microsoft and the FBI, but with new toys. Instead of noisy malware, they’re leaning on “living off the land” tactics—using built‑in tools like PowerShell, WMI, and legitimate remote management software to blend into normal network noise. Security teams at major utilities in places like Texas and the Midwest reported attackers hopping through compromised VPN credentials, then using stolen admin accounts to quietly map out SCADA and OT networks that run substations and grid balancing systems.
A big focus this week has been telecom and routing infrastructure. According to analysts at the SANS Institute and reports quietly circulated inside the Federal Communications Commission, Chinese-linked operators probed edge routers and firewalls from well-known vendors, abusing old firmware and misconfigured BGP to gain visibility into backbone traffic. No Hollywood-style internet blackout, but the kind of foothold that lets you reroute or degrade traffic on command.
Attribution has gotten sharper. The FBI and NSA, working through the Cyber National Mission Force, tied these operations to infrastructure previously used in campaigns against Guam and US defense contractors by tracking reused command-and-control servers, identical encryption routines, and Mandarin-language artifacts in debug strings. Threat intel teams also spotted working hours matching Beijing and Shanghai time zones, plus tooling previously associated with PRC-linked groups like APT41 and APT31.
Defensively, it’s been all hands on deck. CISA pushed out emergency directives to federal agencies to rotate VPN certificates, enforce phishing-resistant multi-factor authentication, and segment OT from IT more aggressively. Several large utilities brought in incident response teams from firms like Palo Alto Networks Unit 42 to deploy network baselining and deep packet inspection around industrial protocols such as Modbus and DNP3. The White House’s Office of the National Cyber Director coordinated with state regulators to run tabletop exercises simulating coordinated Chinese disruption of power and 911 systems.
Cyber experts like Dmitri Alperovitch and former CISA director Chris Krebs hammered home one lesson on cable news and at security conferences: China is not just stealing data; it’s building an options portfolio for real‑world coercion. Meanwhile, current officials at CISA warned that local utilities, hospitals, and small telecoms remain the weakest links—underfunded, understaffed, and now sitting on the front line of a great‑power cyber standoff.
So the takeaway this week: the dragon isn’t breathing fire yet, but it is carefully wiring the detonators.
Thanks for tuning in, listeners, and don’t forget to subscribe so you don’t miss the next breach breakdown. This has been a quiet please production, for more check out quiet please dot ai.
For more http://www.quietplease.ai
Get the best deals https://amzn.to/3ODvOta