China's App Purge and Spy Game Heat Up: 24 Apps Busted While Hackers Hit 70 Countries in Global Cyber Blitz

This is your Digital Dragon Watch: Weekly China Cyber Alert podcast. Hey listeners, Ting here with Digital Dragon Watch, your weekly China cyber alert, diving straight into the hottest threats from the past seven days ending February 6, 2026. Buckle up—China's cyber scene is buzzing with enforcement hammers dropping at home and state-backed spears flying abroad. First off, China's regulators went full beast mode on app devs. The Ministry of Industry and Information Technology, or MIIT, nailed 24 apps and SDKs for sneaky personal info grabs, like forcing permissions and hiding SDK deets, as reported in Bird & Bird's January 2026 update. Shanghai CA yanked 38 non-compliant apps off shelves for ignoring fix-it orders, while Guangdong CA chased five more for excessive data hoarding. Hainan CAC flagged 22 apps missing privacy policies or blocking consent pulls, and CVERC booted 69 others for no pop-up privacy prompts. Even courts got in: Guangzhou Intermediate People's Court slammed Ling from A info tech company for cracking encrypted IMEI codes into plaintext phone numbers, selling them for over 680k RMB—boom, prison time and fines. Fines hit sloppy firms too, like a Changchun pharma co exposing servers to the net, per PSB notices. Abroad, it's espionage central. Palo Alto Networks' Unit 42 unmasked TGR-STA-1030, an Asian state-linked crew—timing screams China interest—breaching 70 gov and crit infra spots in 37 countries since last year. They phished, dropped N-day exploits, rootkits, Cobalt Strike C2, web shells like Behinder, and tunnelers like GOST, lurking months to snag emails on trade deals and military ops. Think Czech Republic post-Dalai Lama meet with President Petr Pavel—hackers reconned army and foreign ministry right after. Norway's Police Security Service just fingered Salt Typhoon, Chinese-backed, hitting vulnerable network gear for spy ops. And don't sleep on DKnife implant: Chinese actors using it since 2019 for adversary-in-the-middle attacks on Chinese desktops, mobiles, even IoT. Targeted sectors? Gov ministries—finance, diplomacy, law enforcement, border control—plus crit infra like telecom and trade hubs. New vectors: edge device exploits over endpoints, per CISA's BOD 26-02 mandating feds ditch unsupported firewalls and routers in 18 months. US response? FBI launched Operation Winter SHIELD February 5, dropping 10 recs like phishing-resistant auth, vuln patching, retiring EOL tech, and third-party audits—weekly deep dives ahead. CISA's hunting TGR exploits with partners; FTC's second ransomware report to Congress hit this week. Expert tips from FBI and Unit 42: Inventory internet-facing assets, encrypt everything, drill incident response, and partner up—solo's suicide against these pros. China firms? Beijing banned Palo Alto and US/Israeli tools, so they're hunkering domestic. Stay sharp, listeners—patch now, auth hard, watch your edges. Thanks for tuning in—subscribe for more dragon slaying! This has been a Quiet Pleas This content was created in partnership and with the help of Artificial Intelligence AI.