China Hacks Hard: Cyber Espionage Bonanza Targets US Orgs, Zero-Days Galore!

This is your Digital Frontline: Daily China Cyber Intel podcast. It’s Ting here on Digital Frontline: Daily China Cyber Intel, and if your endpoint isn’t patched faster than you can say “WinRAR zero-day,” you might want to tune up that firewall pronto. The cyber gloves are off and, wow, China’s state-aligned hacking crews have not taken the weekend off. Let’s dive straight into the latest action targeting U.S. organizations, because the last 24 hours have been a case study in persistent, technically savvy espionage. Let’s start with an alarming attack that hit a U.S. non-profit deeply involved in international policy-making—according to teams from Symantec and Carbon Black, this wasn’t just your garden-variety phishing. The operation, attributed to one of the mainstays like APT41 (also known as Earth Longzhi), Kelp (aka Salt Typhoon), and Space Pirates, showcased their technical ingenuity. Attackers began with mass scanning campaigns leveraging exploits like Atlassian OGNL Injection, Log4j, and Apache Struts—yes, those old bugs the patchnotes warned about. Next, it was all about persistence: curl commands for connectivity checks, netstat to map the digital terrain, and scheduled tasks executing a legit “msbuild.exe” to run stealth payloads, injecting right into the system’s veins. The scheduled task ran every hour as SYSTEM—admin rights, baby, and from there, straight to a command-and-control server out in the ether. But the kicker? Classic DLL sideloading made an appearance. These folks love hijacking legitimate processes—this time via Vipre AV’s “vetysafe.exe” to sneak in a malicious “sbamres.dll” payload, a favorite in recent Space Pirates and Kelp campaigns. Throw in Dcsync for nabbing credentials, plus Microsoft’s Imjpuexc to cement the Chinese tech signature, and you’ve got a blueprint for domain dominance. Sectors in the cyber-crosshairs range from non-profits to telecom and, in ongoing cases revealed by ESET, everything from U.S. trade groups in Shanghai to the Taiwanese defense aviation sector and even energy grids in Central Asia. Group after Chinese group is sharing and reusing each other’s tools, making attribution tricky. Still, the playbook is consistent: network device compromises, adversary-in-the-middle attacks to hijack software updates (special mentions to PlushDaemon and their DNS hijack called EdgeStepper), and slow-cooked persistence aimed at policy influence and strategic eavesdropping. The threat here isn’t just the loss of data; it’s the ability for these actors to quietly sit and wait for the perfect moment to pivot, escalate, or manipulate. J.J. Green at WTOP has called it a “struggle not measured in territory, but in trust, time, and technological control.” The U.S. digital core—with its fragmented defenses—remains an inviting target. What can you do? Security pros are screaming from the rooftops: patch all known vulnerabilities immediately, zero-trust your networks, and scrutinize scheduled tasks and legitimate This content was created in partnership and with the help of Artificial Intelligence AI.