China's Cyber Ninjas Unleashed: Hacking Frenzy Targets US Bigwigs and Cables!

This is your Red Alert: China's Daily Cyber Moves podcast. Hey listeners, Ting here! It’s July 21st, 2025, and I hope you’re buckled in because today’s Red Alert is popping—China’s cyber game has lit up the past few days and, wow, has the action spilled over. Let’s jump straight into today’s hotspot: a new surge of Chinese state-backed cyber maneuvers targeting US infrastructure, business, and, for bonus points, some election-related buzz. Let’s start with what Microsoft dropped just this morning: a bombshell report describing how the line between state hackers and hired cyber mercenaries is super blurry. Think Ocean’s Eleven, but sponsored by Beijing, with Chinese groups enlisting criminal talent to juice up their campaigns. Microsoft says its customers are now seeing over 600 million incidents daily—yes, you heard that right. While China isn’t meddling in the US presidential race quite like Russia and Iran, their “Operation We’re Everywhere” is instead locked onto Congress, state, and local candidates, plus classic targets like Taiwan, Taiwan’s semiconductor sector, and big US tech and defense assets. And about those silicon chasers? According to reporting out of both Singapore and Taiwan, Chinese-linked espionage group UNC3886 has been hammering defense, telecom, and tech orgs across the US and Asia. Mandiant, the Google-owned cyber sleuths, highlighted that these folks run a tight ship—hitting high-value infrastructure, including water and energy, and deploying their blend of custom malware with the finesse of a dim sum chef. Singapore’s cybersecurity heads have called UNC3886 a “serious threat,” and get this: their primary goal? Credential harvesting, lateral movement, and, ultimately, total system compromise. Yesterday, over in Africa, APT41—China’s cyber ninja team—launched a specialized attack campaign targeting government IT with malware-laced SharePoint servers and “living off the land” moves that blend right in with normal network chatter. Kaspersky’s Denis Kulik said these folks are getting creative, embedding proxies and using Cobalt Strike to cloak their command-and-control trickery. Spoiler alert: If you’re not scanning your logs for C# trojans named agents.exe, you’re probably already on their hit list. Back stateside, CISA and the FBI triggered an emergency alert reaching agencies and major US telecoms about suspected Chinese probing of subsea cables—yup, those fiber-optic superheroes carrying 99% of all American internet traffic. FCC Chairman Brendan Carr is now pushing hard for another “Rip and Replace” program, this time targeting subsea cables made by Chinese vendors like Huawei and ZTE. The aftermath of last year’s Salt Typhoon cyberattack has left nerves raw; US officials are scrambling to make sure no single point of failure can drown an entire coast in internet darkness. So here’s your defensive playlist for tonight: Patch all perimeter systems, scrub logs for unusual credential access, validate backups, and if your This content was created in partnership and with the help of Artificial Intelligence AI.