China's Cyber Blitz: Hacked Telecoms, Stealthy Malware, and a Russian Surprise

This is your Digital Frontline: Daily China Cyber Intel podcast. Listeners, Ting here on Digital Frontline, and wow, the last 24 hours have felt like a cyber suspense novel with China in the starring role. Let’s rip the band-aid off and jump straight to the headline: Ribbon Communications, backbone to America’s telecom infrastructure and even some government traffic, has been breached. Investigators traced the attack back to a nation-state—yes, our regulars from Beijing—who managed to camp out in Ribbon’s networks for nearly nine months before being noticed. They vacuumed up troves of historical customer data and poked their way through corporate IT like kids in a candy store. Who else got swept up? At least three other telecoms riding Ribbon’s rails, which translates to cascading impact and lots of worried CIOs. The real trick here was supply chain espionage. Palo Alto Networks spotlighted a China-nexus threat cluster called CL SDA-1009 running their Airstalk malware on VMware’s AirWatch and Workspace ONE platforms. If your organization outsources IT, especially through a BPO provider, you could be China’s next stop. This malware uses stolen code-signing certificates and abuses trusted APIs to sneak out browser data, screenshots, and credentials, all while blending into the digital scenery. It’s stealthy—no flash, just quiet persistence. Now, Cisco device owners, grab your coffee. Chinese actors are actively exploiting two fresh vulnerabilities—CVE-2025-20362 for authentication bypass, and CVE-2025-20333 for remote code execution—on Cisco ASA and FTD devices. The targets are broad: U.S., European, Asian government agencies, and enterprises. The trick is chaining exploits to slip in, spin up rogue admin accounts, and silence the logs so no one notices. The extra twist? Many victims are running end-of-life ASA 5500 series gear, so if you still have those firewalls humming, now’s the time to finally retire them. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive: patch, lock down remote management, and hunt for suspicious admin accounts now. Jumping from tech to tactics, October’s attack wave wasn’t limited to the States. China’s Jewelbug—aka Earth Alux—jumped the fence and breached Russia’s Positive Technologies IT firm, answering one big question: is Chinese cyber aggression strictly aimed West? Apparently not. Jewelbug compromised code repositories, opening doors for multi-national supply chain infiltration. Another hit came from UNC5221, the crew behind the BRICKSTORM backdoor, who stole F5’s BIG-IP source code, including multiple not-yet-public vulnerabilities. Security advisories are flying in thick and fast. Experts at Cyber Management Alliance recommend ramping up detection around unusual API calls in platforms like AirWatch or Workspace ONE, restricting vendor privileges down to bare minimum, and enforcing regular reauthentication. Organizations should also apply the latest patches for C This content was created in partnership and with the help of Artificial Intelligence AI.