China's Cyber Playbook Gets Stealthier: Volt Typhoon, Zero-Days, and Infrastructure Mayhem

This is your Digital Dragon Watch: Weekly China Cyber Alert podcast. Welcome to Digital Dragon Watch: Weekly China Cyber Alert. I’m Ting, your digital sleuth with a sweet spot for all things China, cyber, and a splash of hacking chaos. Let’s skip the pleasantries and zero in on the past week’s most jaw-dropping China-centric cyber moves. Let’s start with the storm that refuses to dissipate—Volt Typhoon. The big revelation? Chinese officials finally, if a bit ambiguously, admitted to US counterparts that they orchestrated cyberattacks targeting American critical infrastructure as part of the infamous Volt Typhoon campaign. This happened quietly at a Geneva summit, where US officials picked up on indirect hints that attacks on everything from energy grids to maritime systems were a response to Washington’s support for Taiwan. What’s truly wild? Sophisticated zero-days were deployed, and the attackers reportedly lurked within segments of the US electric grid for nearly 300 days last year. Talk about patience—and persistence—on the adversary’s part. But Volt Typhoon isn’t working alone. Mandiant just flagged a new offensive: a China-linked threat group exploited an Ivanti vulnerability, CVE-2025-22457, using two freshly crafted malware tools. The prime targets? Critical infrastructure again, with a special eye on communications and transportation networks. The new attack vector relies on exploiting overlooked patch delays and transitions from initial access to custom payloads in record time. This is a textbook reminder: patch fast or risk being a headline. The UK’s Ministry of Defence had its own scare. Chinese hackers allegedly breached a third-party contractor, exposing data on all but special forces. While the UK government was cagey about directly blaming Beijing, insiders pointed fingers at China-linked groups. The lesson here: third-party risk is now the primary attack surface. On the defensive front, policy and tech are both shifting. In China, the Cyberspace Administration just lobbed out amendments to its Cybersecurity Law. The impact? Tougher compliance for anyone touching networked systems, especially operators of “critical information infrastructure,” who must double down on supply chain security and incident response. There’s also a new demand to report serious vulnerabilities to authorities within 24 hours, making cover-ups much harder for local and multinational firms alike. US officials, rattled by Volt Typhoon, are reportedly increasing cooperation between CISA, the FBI, and industry partners, demanding enhanced network segmentation, more aggressive log monitoring, and mandatory multi-factor authentication across targeted sectors. Cyber experts—like John Hultquist from Mandiant—recommend organizations immediately update patch management processes, especially for edge devices, vet third-party suppliers ruthlessly, and run tabletop exercises simulating supply chain intrusions. So, what’s the TL;DR for this week? China’s cyber p This content was created in partnership and with the help of Artificial Intelligence AI.