Chinas Cyber Army Goes Full AI Mode: Hong Kong Hacked, Google Secrets Stolen and IIS Servers Under Siege

This is your Digital Dragon Watch: Weekly China Cyber Alert podcast. Hey listeners, Ting here with your Digital Dragon Watch: Weekly China Cyber Alert, diving straight into the hottest chaos from the past seven days ending January 30, 2026. Buckle up—China's cyber game is leveling up with AI-fueled sneaky strikes, and we're seeing it everywhere from Hong Kong boardrooms to U.S. courtrooms. First off, HKCERT just dropped their bombshell Hong Kong Cybersecurity Outlook 2026 on January 29, revealing a record-shattering 15,877 incidents in 2025—a 27% spike year-over-year. Phishing? Still king at 57%, now supercharged by generative AI making fake WhatsApp and crypto lures indistinguishable from the real deal. Vulnerable systems exploded 3.5 times to 2,328 cases, thanks to lazy patches and misconfigs, while botnets lurked steady at 18%. Looking ahead, their top five 2026 threats scream China vibes: AI-driven attacks like agentic AI gone rogue, weak governance leaking data, supply chain weak spots, cloud over-reliance, and AI gadget bombs. Mr. Edmond Lai from HKPC nailed it—AI's a hacker's dream for stealthy, scalable hits, especially hitting SMEs with zero cyber staff—30% of firms! Across the Pacific, China-linked UAT-8099 went wild on IIS servers in Asia, per Cisco Talos. From late 2025 into early 2026, these bad actors hammered Thailand and Vietnam hardest with BadIIS malware for black-hat SEO fraud. They drop webshells, PowerShell tricks, GotoHTTP for remote control, and tools like Sharp4RemoveLog to wipe traces, CnCrypt to hide files, and OpenArk64 to kill antivirus. Evolving fast—now they dodge blocks on "admin$" accounts by spawning "mysql$" ghosts and regional BadIIS variants like IISHijack for Vietnam and asdSearchEngine for Thai users. Pure persistence porn. Stateside, the Google AI heist verdict dropped: ex-engineer Linwei Ding, aka Leon Ding, convicted on 14 counts for snagging over 2,000 AI trade secrets from May 2022 to April 2023, funneling them to his Shanghai Zhisuan Technologies startup and other PRC-tied firms. DOJ says he faked office badges while chilling in China, pitching investors publicly—busted! Faces up to 15 years per espionage count. Echoes broader insider woes, like Check Point noting state-sponsored hackers luring U.S. firm employees with $3K-$15K bribes. US gov responses? Trump's crew is offense-obsessed, per Homeland Security Newswire, pushing Cyber Command's persistent engagement against Beijing's massive apparatus—think Volt Typhoon and Salt Typhoon planting infrastructure "time bombs." But critics slam it as miscalculating China's scale; CISA's gutted on budget and staff, ditching Biden-era software rules as "burdensome." White House eyes China procurement bans, maybe even Letters of Marque for private-sector counterpunches, while Beijing bars U.S./Israeli cyber tools. GovLoop predicts unified Risk Operations Centers over old SOCs, AI-driven to preempt threats amid Taiwan tensions. Targeted sectors? Critical inf This content was created in partnership and with the help of Artificial Intelligence AI.