Beijing's Cyber Blitz: US Agencies Scramble as China Hacks and Spies

This is your Digital Frontline: Daily China Cyber Intel podcast. Listeners, Ting here on Digital Frontline, and trust me—if you’ve been hoping the Labor Day cyber lull would last, brace yourselves. Over the last 24 hours, US cyber defenders have been running full sprint. Let’s cut straight to the chase on the latest in Chinese cyber activity targeting US interests. Early this morning, news broke of a suspected spear-phishing campaign traced to APT41, the notorious Chinese state-linked hacker collective. Get this: they impersonated Representative John Moolenaar—yes, the same Moolenaar who heads the committee on US-China strategic competition. Their ploy? Malware-laced emails sent to US trade groups and federal agencies, with a fake legislative draft as the hook. These emails aimed to worm into the communications around the Trump administration’s ongoing trade talks with Beijing. US authorities, including the FBI and the Capitol Police, are deep in this investigation, and, so far, no successful breach is confirmed. Still, the timing—just before the trade talks in Sweden—gives us a live demo of the alignment between China’s cyber ops and high-stakes geopolitics. As you’d expect, Beijing has issued their boilerplate denials while US cyber threat advisories have shifted from code yellow to code caffeine-fueled panic. The joint advisory from the US and allies—including the UK, Japan, and Germany—specifically called out three Chinese tech firms: Sichuan Juxinhe Network Technology, Beijing Huanyu Tianqiong Information Technology, and Sichuan Zhixin Ruijie Network Technology. These companies are now officially accused of acting as cyber supply shops for China’s intelligence services. The prime suspect here is Salt Typhoon, a threat actor linked with siphoning massive amounts of US call records, including targeting Washington’s senior leadership. Sectors under heaviest fire in the past day? Communications, transportation, and government networks—classic high-value targets. Volt Typhoon has also been fingered for persistent activity in these same verticals, and the trend is definitely up. I’m seeing a lot more attempts using AI-driven malware, exploiting zero-day vulnerabilities, and leveraging ransomware-as-a-service kits—some of which are tailored to bypass typical US enterprise defenses. The latest defensive advisories, courtesy of CISA and private sector buddies like HackerStrike and Cloud9, urge everyone—yes, that includes your boardroom and your back office—to step up patching routines, review email authentication protocols, and double down on zero-trust security architecture. AttackIQ just updated simulated threat templates against advanced persistent threats like Salt Typhoon, focusing on code injection and scheduled task persistence. If you haven’t tried running breach-and-attack simulations with the new templates, do it now. Your insurance adjuster will thank you later. Expert consensus is clear: this renewed cyber onslaught is not random. I This content was created in partnership and with the help of Artificial Intelligence AI.