ArcaneDoor Strikes Again: China's Triple-Threat Cyber Smackdown on US Gov Networks

This is your Digital Dragon Watch: Weekly China Cyber Alert podcast. Digital Dragon Watch is on the air with your weekly China Cyber Alert, and listeners, this one is a blockbuster. Ting here—your cyber-savvy dragon wrangler—breaking down the relentless, high-stakes contest of wits between US defenders and, you guessed it, China’s Ministry of State Security, the MSS. The MSS isn’t your grandma’s old-school spy shop anymore. According to a major feature from Breached Company, this agency has morphed into the most formidable cyber-espionage machine on the planet, tactically blending stealth, zero-days, and a massive contractor hacker network. Their latest move? Orchestrating the Salt Typhoon campaign, quietly rooting through at least nine major US telecoms and slipping into dozens of networks worldwide. That’s just the surface—like the tip of a cyber berg that’s mostly underwater, lurking. But the showstopper this week: the ArcaneDoor 2.0 breach. Let’s talk about what Techno Tips Learning and a CISA emergency directive both confirm—Chinese state-sponsored attackers used a triple-whammy of zero-day vulnerabilities, tracked as CVE-2025-20333, CVE-2025-20362, and a secretive CVE-2025-20363, slamming into Cisco ASA and Firepower devices across US government networks. These aren’t holes you just throw a firewall at—ArcaneDoor’s RayInitiator bootkit and the LINE VIPER payload let hackers survive reboots and firmware updates, which is the cybersecurity equivalent of hiding in your house even after you’ve rebuilt the whole thing. The Campaign’s so advanced, it forced the Cybersecurity and Infrastructure Security Agency, or CISA, to issue Emergency Directive ED-25-03. Agencies had 24 hours—yes, 24!—to hunt down every possibly-compromised Cisco device, apply patches, and send forensic dumps to CISA. Miss the deadline? Disconnect by September 30. This is zero tolerance for zero-day. ArcaneDoor isn’t a new face—security firms like Palo Alto Networks and BitSight trace this crew back to 2024, ratcheting up pressure with evolving methods. This time, critical infrastructure providers caught some of the worst shrapnel, and international partners like the UK’s NCSC and Canadian cyber teams jumped in, highlighting how vulnerable edge devices—those gateways between you and the internet—are targets now, not just backdoors. Want more Dragon detail? Cisco Talos published findings on another Chinese-speaking crew, Naikon, launching PlugX campaigns straight at Asian telecom and manufacturing orgs, leveraging legit software to sideload malware that quietly unpacks itself in memory. They’re sharing tools with BackdoorDiplomacy, blurring lines between separate groups and, frankly, confusing defenders everywhere. US officials aren’t mincing words. CISA’s Chris Butera called the threat “widespread” and warned all, not just federal agencies, to patch, patch, patch—especially if you run anything named Cisco in your network. And over at the White House, an emergency interage This content was created in partnership and with the help of Artificial Intelligence AI.