China's Cyber Crews: Spear-Phishing for Gold, Impersonating Congress, and Unleashing the Qilin

This is your Digital Frontline: Daily China Cyber Intel podcast. It’s Friday, September 19, 2025, and you’re plugged into Digital Frontline with Ting – your guide to all things China, cyber, and the latest hacking hullabaloo. Let’s slide right into today’s intel because the Red Dragon has been busy. Seriously, if there were Olympics for spear-phishing, China’s cyber crews would be printing gold medals right now. First up, an audacious move: Chinese-linked hackers this week impersonated Congressman John Moolenaar—chairman of the House Select Committee on U.S.-China Strategic Competition—blasting off fake emails that looked eerily like official requests for “input” on draft sanctions law. These landed in inboxes of U.S. officials, multinational execs, law firms, think tanks—heck, even a foreign government. Nothing fancy tech-wise, but the social engineering? Chef’s kiss. The ruse played off the real Capitol Hill process of circulating draft language and asking for feedback, so busy recipients let their guard down—and that’s where credentials went missing and malware went live. The FBI and Capitol Police are deep into the investigation, but the lesson couldn’t be clearer: social credibility is a more dangerous weapon than zero-days sometimes. This is just the latest chapter in a wider playbook. China’s APT groups continue to up their game, from TA415’s custom spear-phishing targeting U.S.-China policy experts—using spoofed congressional identities and phishing lures referencing current economic hot buttons—to broader attacks leveraging manipulated cloud tokens, cozying up inside government and critical infrastructure nets. Meanwhile, over in the private sector, Mustang Panda has been dropping shiny new worms—like the SnakeDisk USB worm—designed to activate exclusively on certain regional IPs. That’s selective targeting with a dash of mystery sauce. And the Qilin ransomware gang, no friendly panda, is now elbowing other crews aside as the leading headache for U.S. state and local governments by cranking out double-extortion attacks—encrypting data and chucking stolen files online if you don’t pay up. Their initial breach route? Still the usual suspects: phishing and exploiting known vulnerabilities. If you sleep on patching or don’t double-check your email origin, Qilin’s in. Let’s talk defenses. The Pentagon just banned cloud vendors from using China-based personnel on DoD systems, triggered by revelations that Microsoft for years let engineers in China work on sensitive U.S. government platforms—whoops! New rules say only non-adversarial nationals can touch these networks, and every foreign access event must now have exquisitely detailed audit logging and a “digital escort.” The SEC just announced a cross-border fraud task force with a special focus on China—so compliance teams, sweep your house. Cross-sector, it’s time to rehearse those “Congress emailed us” tabletop drills, lock down policy positions, and verify any suspicious outreach bef This content was created in partnership and with the help of Artificial Intelligence AI.