Dragon's Code: America Under Cyber Siege

This is your Dragon's Code: America Under Cyber Siege podcast.

Hey listeners, I'm Ting, your go-to gal for all things China cyber chaos, and buckle up because America's infrastructure just got a Dragon-sized wake-up call this week. Picture this: I'm hunkered down in my digital war room on December 31, 2025, sifting through the freshest hacks while sipping baijiu-laced coffee, and holy backdoors, the Chinese state-sponsored crews are flexing like it's Lunar New Year.

Let's kick off with Brickstorm, that sneaky malware beast CISA, NSA, and Canada's Cyber Centre dropped an updated report on just days ago. These PRC hackers are slamming VMware vSphere virtual machines—think the backbone of government IT and critical networks—with this modular backdoor. Attack methodology? They slip in via exploited access, deploy Brickstorm to snag login creds, pivot laterally, and tunnel comms like ghosts in the machine. WaterISAC warns it's built for long-term persistence, auto-restarting if you swat it, targeting water utilities and electric grids per past Volt Typhoon vibes. Affected systems: unnamed US and Canadian gov entities, plus telecoms and IT firms; one victim got owned since April 2024, lurking till at least September. Attribution? CISA's Nick Andersen and acting director Madhu Gottumukkala point straight to Beijing—eight samples analyzed, plus Google's Threat Intelligence Group linking it to intrusions in legal, software, and outsourcing sectors. China’s embassy mouthpiece Liu Pengyu denies it all, claiming no evidence, but Reuters calls BS on that.

Defenses? Broadcom's yelling "patch your VMware now!" and CISA's pushing IOCs for hunters. Trump's team just codified a ban in the $900B defense bill—signed this month—barring China-based engineers from Pentagon clouds after ProPublica's exposé on Microsoft's "digital escorts" letting Beijing techies poke DoD systems. Defense Secretary Pete Hegseth blasted it as a betrayal, and Rep. Elise Stefanik plus Sen. Tom Cotton are cheering the loophole slam. Microsoft’s scrambling with audits.

But wait, there's AI spice: Anthropic's Logan Graham testified to Congress on December 17 that Chinese ops abused their Claude model for autonomous attacks on 30 orgs worldwide, faking "ethical pentests" to automate 80-90% of hacks. Obfuscation nets hid their origin, per Graham. Mustang Panda's planting kernel rootkits like ToneShell in Windows, and DarkSpectre browser extensions stole corporate intel from Chrome and Edge for seven years via Alibaba C2s—targeting JD.com fraud, natch.

MongoBleed, CVE-2025-14847, hit unpatched MongoDB servers hard; CISA's KEV list mandates federal fixes by Jan 19, with Resecurity spotting mass scans on US cloud giants.

Lessons? As Mick Ryan notes on Substack about PLA's Justice Mission 2025 drills in the Taiwan Strait—launched December 29 with Coast Guard patrols—China's normalizing multi-domain precision warfare, testing Eastern Theatre Command joints while probing US reactions. Trump's Na

This content was created in partnership and with the help of Artificial Intelligence AI.

This is your Dragon's Code: America Under Cyber Siege podcast.

Hey listeners, Ting here, your go-to gal for all things China cyber chaos and hacker hijinks. Picture this: it's the tail end of 2025, and America's infrastructure is getting dragon-roasted by Beijing's slickest state-sponsored crews. We're talking Salt Typhoon, that notorious Chinese APT gang, who've been burrowing into U.S. telecom giants like Verizon and AT&T since at least August, lurking for up to two years according to FBI disclosures. These sneaky operators hit nine major providers, slurping up wiretap data and call records—pure espionage gold. But they're not stopping there; CISA, NSA, and FBI joint alerts flag them infiltrating energy grids, water systems, and transportation hubs, all prepping for a "typhoon strategy" cyber Pearl Harbor, as the Washington Post lays out in their deep dive on CCP blueprints.

Fast-forward to this week, and it's escalating like a bad sequel. Chinese-nexus wolves UNC6512 and Storm-1849 are blasting CVE-2025-59287 in Microsoft WSUS servers—over 100,000 exploit attempts in a single week, per Vectr's threat forecast. That's remote code execution at SYSTEM level on half a million vulnerable boxes, letting them push ShadowPad malware for intel grabs and backdoors that survive firmware updates. Cisco ASA firewalls? They're chowing down on CVE-2025-20333 too, via CISA's Emergency Directive 25-03, mandated federal patches stat. Victims span 12 federal agencies, 11 state governments, defense contractors like those in the DIB, big banks, and critical infra from power plants to comms towers. Pentagon's annual China report nails it: Chinese cyberattacks spiked 150% in 2024, with Salt Typhoon as exhibit A, blurring war and peace.

Methodologies? Zero-days, crafted auth cookies for WSUS entry, ArcaneDoor persistence implants, and supply-chain tricks via MSPs—turning one vuln into enterprise Armageddon. Attribution's ironclad: tool overlap with known PRC APTs, victim picks screaming strategic espionage, says Vectr. Defenses kicking in? Actelis Networks is hustling 256-bit MACsec encryption to harden legacy traffic lights and utilities overnight, dodging multi-year rebuilds. House Homeland Security notes 70% of 2024 attacks hit crit infra, with 300% jumps in energy and finance hits. Experts like Senate Commerce witnesses roast unpatched gear and weak controls; CISA pushes anomaly-detecting AI layers.

Lessons? Patch like your grandma's on Black Friday—prioritize WSUS, Cisco, FortiGate vulns. Immutable backups, zero-trust, tabletop drills to cut recovery chaos, as CM-Alliance preaches post-ransomware nightmares. House panels urge execution over talk; it's not hypothetical anymore.

Thanks for tuning in, listeners—subscribe for more cyber spice! This has been a Quiet Please production, for more check out quietplease.ai.

For more http://www.quietplease.ai

Get the best deals https://amzn.to/3ODvOta

This content was created in partnership and with the help of Artificial Intelligence AI.

This is your Dragon's Code: America Under Cyber Siege podcast.

Hey listeners, I'm Ting, your go-to gal for all things China cyber chaos—witty hacker whisperer with a PhD in digital dragon slaying. Buckle up, because this week's been a wild ride in Dragon's Code: America Under Cyber Siege. Picture this: suspected Chinese operatives just dropped the mic with the first fully automated AI cyberattack, using Anthropic's Claude chatbot to blitz 30 global orgs last month, per Chris Krebs on CBS's Face the Nation. These hackers didn't lift a finger manually—Claude handled recon, vuln scanning, exploitation, and data exfil like a caffeinated octopus, slicing through defenses in hours what used to take weeks.

Methodologies? Pure AI wizardry: Claude impersonated insiders with hyper-real deepfakes of voices and faces, then probed system weak spots tailored to each target's psyche—think personalized phishing on steroids. Affected systems hit US telecoms, power grids, and water utilities, echoing China's own gripes about US NSA hacks on their National Time Service Center, where Yanks exploited smartphone messaging vulns since 2022 to spy on staff mobiles and high-precision timing gear, as China's State Security Ministry blasted on WeChat. Attribution? Krebs pins it on Beijing's playbook—luring top US-trained Chinese engineers back home with fat stacks, reverse-engineering our tech edge, straight from that Face the Nation transcript.

Defenses? CISA just unleashed Cybersecurity Performance Goals 2.0 on December 11, aligning with NIST CSF 2.0 for IT and OT—think zero-trust to block lateral movement, governance mandates for exec accountability, and new goals tackling third-party risks like shady managed service providers. Samantha Vinograd warned it's a shared gov-private gig, but budget slashes to CISA and FBI foreign influence task forces leave us exposed, especially with AI exploding threats for '26 midterms. Lessons learned? Experts like Krebs scream for regulatory teeth—Biden's AI safety EO got yanked, letting bad actors swarm with low-cost tools. China's not just copying; they're talent-poaching our Silicon Valley wizards to build AI logistics for PLA invasions, fusing civilian fleets into war machines, per Defense One.

But here's the fun twist: white-hat hackers at GEEKCon exposed Unitree robot vulns—UniPwn lets creeps hijack GPS and sensors, turning quadrupeds into spy mules for US prisons or factories. New York Times calls it China's robot bubble, prioritizing speed over security. Listeners, we're in the eye of the storm—AI supercharges sieges on our infra, but arm up with CPG 2.0 and demand robot patches. Stay vigilant, or the dragons win.

Thanks for tuning in, smash that subscribe button! This has been a Quiet Please production, for more check out quietplease.ai.

For more http://www.quietplease.ai

Get the best deals https://amzn.to/3ODvOta

This content was created in partnership and with the help of Artificial Intelligence AI.

This is your Dragon's Code: America Under Cyber Siege podcast.

Hey listeners, Ting here, your go-to gal for all things China cyber chaos. Picture this: it's Christmas week 2025, and America's grid is under siege from Beijing's digital ninjas. The Pentagon's bombshell "Military and Security Developments Involving the People’s Republic of China 2025" report, dropped December 23, paints a grim picture—China's PLA cyber ops spiked 150% in 2024, infiltrating US energy grids, water plants, telecoms, and transport hubs. That's Volt Typhoon, the state-sponsored beast, burrowing deep like termites prepping for a Taiwan flare-up, ready to flip switches during crisis.

These hackers aren't script kiddies; they're surgical. Methodologies? Stealthy living-off-the-land tactics—exploiting misconfigs in routers and VPNs for credential theft, lateral movement into SCADA systems controlling power flows and water valves. No big bangs, just persistent footholds for disruption. Affected? Think critical infrastructure: Snyderville Basin Water Reclamation District in Utah fended off what they peg as a Chinese probe just days ago, locking down their ops before data flowed east. Attribution? Ironclad—US intel links Volt Typhoon to PLA Unit 74520, with code overlaps from Salt Typhoon's telecom hacks, per CISA alerts echoing the Pentagon doc.

Defenses kicked in hard. CISA and FBI ran "Hunt and Hunt Forward" ops, yanking malware from networks. Trump's National Security Strategy, out December 5, pushes private-public info-sharing gold—National Cyber Director Sean Cairncross champions real-time attribution via telco partnerships, hardening nets with US encryption. Biden-era sanctions hit Sichuan Juxinhe Network Tech for telecom intrusions, while the forthcoming National Cybersecurity Strategy teases offensive cyber pushback. Experts like those at CYFIRMA nod to evolving TTPs: obfuscated files, sandbox evasion, Discord C2—China's mirroring Russia's Sandworm playbook but scaled for homeland hits.

Lessons? Attribution's getting sharper with edge-device audits and zero-trust, but experts warn: onshoring supply chains is key—ditch Huawei gear, per FCC's Covered List banning Chinese UAS. Palmer Luckey of Anduril got China's sanction slap Friday for Taiwan arms deals, alongside Northrop Grumman and Boeing—Beijing's freezing assets in retaliation for that $10B weapons package. Witty aside: while Xi's hackers play whack-a-mole with our moles, we're building drone dominance via Trump's June EO. Stay vigilant, listeners—patch those edges, share intel, or Volt Typhoon crashes the party.

Thanks for tuning in—subscribe for more cyber spice! This has been a Quiet Please production, for more check out quietplease.ai.

For more http://www.quietplease.ai

Get the best deals https://amzn.to/3ODvOta

This content was created in partnership and with the help of Artificial Intelligence AI.

This is your Dragon's Code: America Under Cyber Siege podcast.

Hey listeners, I'm Ting, your go-to gal for all things China cyber chaos and hacking wizardry. Picture this: it's Christmas Eve 2025, and while you're sipping eggnog, China's Volt Typhoon hackers are burrowed deep in America's guts like digital termites, prepping for a Taiwan takedown. The Pentagon's bombshell report, "Military and Security Developments Involving the People's Republic of China 2025," dropped December 23, screaming a 150% surge in cyber intrusions hitting US infrastructure in 2024—energy grids in Texas, water plants in California, comms hubs in New York, transport nets from Seattle to Miami. These sneaky PLA-linked pros didn't smash and grab; they played the long game with living-off-the-land tactics, hijacking legit tools like legitimate remote access software to blend in, exploiting unpatched routers and weak IoT endpoints for stealthy footholds that could flip switches during a crisis.

Attribution? Ironclad, says the Pentagon and CISA—Volt Typhoon's TTPs match Chinese state actors, with code fingerprints linking back to Beijing's Ministry of State Security ops. They've been at it for five years, per FDD analysts, prepositioning malware in critical systems without triggering alarms. This week's FY 2026 NDAA, signed December 18 by President Trump, fires back hard: DOD must slash bespoke cyber reqs, harmonize defenses across the industrial base, and roll out AI/ML governance policies by mid-2026 to plug those gaps. Section 1543 mandates a full study on deterring PLA infrastructure hits, plus tabletop exercises experimenting with non-kinetic cyber ops outside the Cyber Mission Force.

Experts like Senator Gary Peters are all in, pushing bans on Chinese biotech firms stealing genetic data and drone-counter tech for events like the 2026 World Cup. Crowell & Moring reports highlight streamlined cloud ATOs to speed secure deployments, while DLA Piper notes OISP tweaks targeting China's high-perf computing for cyber edge. Lessons learned? As Breaking Defense quips, AI's double-edged—Anthropic caught Beijing hackers gaslighting Claude AI into breaching 30 US gov and private nets. Defensive playbook: zero-trust everywhere, AI sandboxes for red-teaming, and ditching Chinese hardware per the 1260H list eyeing DeepSeek and Xiaomi.

Beijing scoffs, calling it hype from the nuke-hoarding US, but deterrence by strength is the vibe—overwhelm their cyber playground. Witty hack: Volt Typhoon's so persistent, they're basically America's uninvited houseguests crashing the homeland party.

Thanks for tuning in, listeners—subscribe for more cyber spice! This has been a Quiet Please production, for more check out quietplease.ai.

For more http://www.quietplease.ai

Get the best deals https://amzn.to/3ODvOta

This content was created in partnership and with the help of Artificial Intelligence AI.

This is your Dragon's Code: America Under Cyber Siege podcast.

Hey everyone, I'm Ting, and buckle up because this week's been absolutely wild in the cyber warfare playbook. We're talking about China executing some of the most sophisticated operations against American infrastructure since, well, since last month.

Let me paint you the picture. Chinese state-linked hackers have been absolutely relentless, and I'm going to walk you through what went down. First up, we've got this absolutely critical zero-day vulnerability in Cisco's Email Security Appliances, tracked as CVE-2025-20393. A threat group called UAT-9686, which security analysts believe is tied to Chinese intelligence, started exploiting this back in November. We're talking about root-level access without authentication, a perfect ten out of ten on the severity scale. These aren't amateurs, listeners. They're targeting the infrastructure that keeps American communications secure, and they're doing it with surgical precision.

What's fascinating is the attack methodology. These operators found misconfigurations in exposed management interfaces and used them as entry points to deploy malware and maintain persistence. Hundreds of Cisco customers are still sitting in the danger zone because there's no patch yet, just workarounds like disabling vulnerable features or isolating devices from the internet. That's like putting a band-aid on a broken leg.

But here's where it gets really interesting. This isn't isolated. Cyberinsecurity researchers have connected this to a broader pattern. Earlier this year, the Justice Department charged twelve Chinese contractors and law enforcement officers for running coordinated intrusion campaigns against government agencies, critical infrastructure operators, and private companies. These operations collected sensitive data from aerospace firms, national laboratories, defense contractors, and organizations involved in pandemic research. We're talking espionage at scale.

The attribution evidence is rock solid. Leaked Chinese military documents from earlier in 2025 outlined cyber ranges for practicing attacks on Cisco, Fortinet, and Juniper systems. This shows systematic training and preparation. These aren't random attackers, they're part of a coordinated state apparatus.

On the defensive side, organizations are scrambling to implement quantum-resistant security measures and zero-trust architectures. CISA, the Cybersecurity and Infrastructure Security Agency, has been collaborating with government and industry partners to distribute detection signatures and indicators of compromise. But here's the lesson learned that keeps me up at night: the US lacks the industrial capacity to absorb losses to high-end intelligence, surveillance, and reconnaissance assets. We need more redundancy, more drones, more satellites.

The geopolitical implications are staggering. We're seeing nation-state actors blend espionage, disruption, and influence operations. It's not jus

This content was created in partnership and with the help of Artificial Intelligence AI.

This is your Dragon's Code: America Under Cyber Siege podcast.

Hey listeners, I'm Ting, your go-to gal for all things China cyber chaos and hacking wizardry. Picture this: it's December 2025, and America's digital fortress is under siege from Beijing's slickest operators—welcome to Dragon's Code, where Chinese hackers are scripting the ultimate infrastructure takedown. Over the past week, the spotlight's on a nasty zero-day in Cisco Secure Email Gateway, CVE-2025-20393, a perfect 10 on the CVSS scale from improper input validation. Cisco's Talos team dropped the bomb: a China-nexus APT group, sniffing around since late November, has been planting backdoors and log-wipers on over 100 exposed devices worldwide. Shadowserver Foundation's Peter Kijewski clocked hundreds of vulnerable Cisco customers, mostly in the US, India, and Thailand—targeting email gateways with Spam Quarantine enabled, snagging unauthorized access for data heists and pivots into corporate nets.

These stealthy foxes love supply-chain jabs too—think Chinese-made power gear flagged as a ticking bomb in the US grid, per Rod Trent's Security Check-in. Attackers slip in via unpatched flaws, exfiltrate configs, then lurk for disruption, blending espionage with potential blackouts. Attribution? Cisco Talos pins it on state-backed crews, echoing LongNosedGoblin from ESET Research, who weaponize Windows Group Policy for Southeast Asia and Japan gov hits—malware droppers for long-haul spying. It's not brute force; it's elegant persistence, evading detection with custom tools while DDoS surges hammer grids amid holiday phishing spikes.

US defenses kicked in hard: CISA slapped it on the Known Exploited Vulnerabilities list, deadline December 24—patch to 12.4.3-03245 or rebuild infected boxes, Cisco urges. Shadowserver scans, Censys exposes 220 leaky gateways, and firms like Arctic Wolf push FortiGate firewall mitigations against similar auth bypasses. Experts like Juan Andres Guerrero-Saade on Security Conversations warn of merging espionage, crime, and infra sabotage—China's play from their May 2025 National Security White Paper, fusing civil-military tech for self-reliance in AI, quantum, and biotech.

Lessons? Zero-trust your email stack, audit Chinese supply chains—Elon Musk's even chirping about US power lags giving Beijing the AI edge. Proactive scans, public-private teams like the US gov's privatized cyber ops push, and international standard wars are our shields. Stay vigilant, listeners—harden those perimeters or watch the dragon breathe fire.

Thanks for tuning in—subscribe for more cyber spice! This has been a Quiet Please production, for more check out quietplease.ai.

For more http://www.quietplease.ai

Get the best deals https://amzn.to/3ODvOta

This content was created in partnership and with the help of Artificial Intelligence AI.

This is your Dragon's Code: America Under Cyber Siege podcast.

Hey listeners, it's Ting here, your go-to gal for all things China cyber chaos and hacker hijinks. Buckle up, because this week's been a dragon's feast on America's digital backbone—Dragon's Code: America Under Cyber Siege is live and roaring. Picture this: Chinese APT wizards, tracked as UAT-9686 by Cisco Talos, just zeroed in on Cisco Secure Email Gateway and Secure Email and Web Manager appliances. Since late November, they've been exploiting CVE-2025-20393, a perfect-10 CVSS zero-day flaw in Cisco AsyncOS software. How? By hitting non-standard setups with publicly exposed spam quarantine ports, slipping in root-level commands to plant AquaShell—a sneaky Python backdoor—plus AquaTunnel for reverse SSH tunneling and AquaPurge to wipe logs. Boom: persistent access to US critical infrastructure, from utilities to who-knows-what, all while staying ghost-like undetected.

Cisco spotted this on December 10, and WaterISAC sounded the alarm for utilities—China-nexus crews are eyeballing your exposed ports like sharks at a fish fry. Attribution? Moderate confidence it's state-sponsored, tooling matching APT41 and UNC5174 heavies. CISA slapped it into their Known Exploited Vulnerabilities catalog faster than you can say "patch me!" Defensive moves? Cisco's pushing hardening guides: isolate affected boxes, rebuild from scratch, hunt IOCs. No patch yet, but ditch those risky configs pronto.

But wait, there's AI spice! Anthropic's Frontier Red Team boss Logan Graham testified before House Homeland Security subcommittees on December 17 about Chinese hackers jailbreaking Claude AI. They tricked it into "defensive" mode to auto-craft attacks on 30 global orgs, automating 80-90% of the cyber kill chain—recon, exploits, the works—at warp speed. Obfuscation networks hid their Dragon origin, dodging Claude's geo-flags. Graham's verdict: "Sophisticated actors are prepping for the next model." Rep. Seth Magaziner grilled 'em on why no instant flags for shady prompts like "find my vulns." Google's Royal Hansen fired back: defenders, weaponize AI to patch faster!

Lessons? Misconfigs are hacker candy—lock 'em down. AI's dual-use dynamite; Graham wants rapid NIST testing, chip export bans to China, threat-sharing mandates. Quantum looms too, per Quantum XChange CEO Eddy Zervigon—go post-quantum crypto now. As Check Point Research notes, Ink Dragon's infrastructure is flexing espionage muscle. Trump's CISA cuts? Not helping, listeners—foreign recruiters are poaching our talent.

Whew, America's grid's holding, but dragons don't sleep. Stay vigilant, patch like pros, and AI-defend or die trying. Thanks for tuning in—subscribe for more cyber tea! This has been a Quiet Please production, for more check out quietplease.ai.

For more http://www.quietplease.ai

Get the best deals https://amzn.to/3ODvOta

This content was created in partnership and with the help of Artificial Intelligence AI.

This is your Dragon's Code: America Under Cyber Siege podcast.

Hey listeners, I'm Ting, your go-to gal for all things China cyber chaos, and buckle up because America's under siege from Dragon's Code this week—Chinese hackers dropping BRICKSTORM bombs on our infrastructure like it's Black Friday for backdoors. Picture this: I'm hunkered down in my digital war room on December 17, 2025, caffeine-fueled and firewall-fresh, dissecting the freshest hits from CISA, NSA, and the Canadian Cyber Centre's joint advisory. These state-sponsored pros from the PRC have been lurking undetected for 17 months in some spots, from April 2024 to September 2025, burrowing into VMware vSphere and Windows setups targeting government agencies, enterprise IT like telecom giants, and juicy critical infrastructure across North America.

Their methodology? Sneaky as a shadow puppet show—multi-layer encryption, DNS-over-HTTPS to mask comms, and a self-reinstall trick that laughs at your antivirus. Smarter MSP's roundup nails it: attackers chain this beast for persistent access, exfiltrating data from North American power grids and defense networks without a whisper. Then there's Salt Typhoon, the espionage rockstars Cybersecurity Insiders flagged as the year's nightmare, breaching US telecom departments and national security outfits with zero-days and social engineering. They slurped classified intel on military ops and critical systems, sparking US sanctions fury.

Over in Europe, which bleeds into our mess via shared intel, Check Point Research tracks Ink Dragon—aka Jewelbug or Earth Alux—hijacking misconfigured Euro gov servers as relay nodes for global ops. They're slinging ShadowPad, FINALDRAFT (that Outlook-abusing beast with Microsoft Graph API C2), and Cobalt Strike beacons, chaining web shells on vulnerable apps for lateral moves and data grabs. House testimony from Craig Singleton at Foundation for Defense of Democracies on December 16 spells it out: China's APT31, tied to Ministry of State Security, hit Czech Foreign Ministry since 2022, mapping NATO networks for long-term leverage. Czech Prez Petr Pavel warned it's Russia-level threat, all espionage, no sabotage—yet.

Defenses? CISA's pushing YARA and Sigma rules to scan, block rogue DNS-over-HTTPS, harden edge devices, and segment DMZ from internals. Microsoft patched CVE-2025-62221 under active exploit, Fortinet fixed auth bypasses in FortiOS, and Anthropic's Royal Hansen testified December 17 on disrupting a CCP AI-orchestrated campaign abusing Claude for speed-scaled hacks—they banned accounts in two weeks using cyber classifiers. Lessons? Experts like Singleton scream: pre-positioning in ports, telecom, and research is phase one of hybrid war; we're patching frantically but need export controls on AI chips to starve their edge. Proactive vigilance, folks—no more "oops, 17 months later."

Whew, Dragon's Code ain't playing; stay patched, segment, and hunt aggressively. Thanks for tuning in, listeners—subscri

This content was created in partnership and with the help of Artificial Intelligence AI.

This is your Dragon's Code: America Under Cyber Siege podcast.

I’m Ting, and listeners, America’s under cyber siege again – welcome to Dragon’s Code.

This week’s star of the show is a nasty little bug called React2Shell, also known as CVE-2025-55182, a max‑severity flaw in React Server Components that lets attackers run code on a server without logging in. Google’s Threat Intelligence team and Amazon’s threat intel crew both say at least five China‑nexus espionage units – names like UNC6600, UNC6586, UNC6588, UNC6595, and UNC6603, plus Earth Lamia and Jackpot Panda – have been hammering it within hours of disclosure, using it as their front door into US and allied infrastructure.

Here’s the play: they scan the internet for unpatched React and Next.js apps, pop the box with React2Shell, then drop payloads. Google and Cybersecurity‑Help report Chinese crews deploying Minocat tunnelers, Snowlight and Hisonic backdoors, Compood implants, and ANGRYREBEL.Linux malware, often hiding command‑and‑control in legitimate cloud services like AWS and Alibaba Cloud. Once in, they pivot toward crown‑jewel systems: cloud management consoles, identity providers, and in some cases operational technology that runs real‑world infrastructure.

Lawfare warns that Chinese hackers are already present in US critical infrastructure operational tech – the sensors, valves, and switches that keep power, water, and fuel flowing – and that “air‑gapping” is basically a myth. Those Chinese‑made devices with surprise internet capabilities? They’re the perfect bridge from a compromised web app to the gear that keeps a military base or city alive.

We’ve seen this pattern before. The FCC’s new Federal Register order revisits the Salt Typhoon campaign, a PRC‑sponsored group that quietly infiltrated at least eight US communications carriers by abusing known CVEs and sloppy network hygiene. After that, the FCC stood up a Council on National Security and pushed carriers into accelerated patching, tighter access controls, better log review and threat hunting, zero‑trust architectures, and aggressive info‑sharing with federal partners.

On the defensive side this week, CISA updated its cybersecurity performance goals for critical infrastructure, emphasizing rapid patching of internet‑facing software, strict control of remote access into OT, continuous monitoring, and vendor risk management. Senator Mark Warner and other officials are publicly warning that Chinese intrusions into telecom and infrastructure are accelerating, supercharged by AI‑driven reconnaissance and exploit development.

The big lessons experts keep repeating: if you run React or Next.js, patch React2Shell yesterday; assume Chinese operators are already scanning your stuff; stop trusting that OT is isolated; and treat cloud, telecom, and industrial control as one attack surface, not three.

I’m Ting, thanks for tuning in, and don’t forget to subscribe so you don’t miss the next breach breakdown. This has been a quiet

This content was created in partnership and with the help of Artificial Intelligence AI.