China's Cyber Rampage: Exchange Hacks, AI Theft, and the Spy Tools Hiding in Your Discord Chats

This is your Red Alert: China's Daily Cyber Moves podcast. Hey listeners, Alexandra Reeves here with your Red Alert on China's daily cyber moves. Over the past few days leading into this Friday morning, a China-aligned threat group called SHADOW-EARTH-053 has been rampaging through unpatched Microsoft Exchange servers, exploiting those old ProxyLogon vulnerabilities from 2021—CVE-2021-26855 and crew—to hit government ministries and critical infrastructure. Trend Micro's latest report nails it: they've compromised targets in South, East, and Southeast Asia, plus a NATO member state, dropping GODZILLA web shells for persistence and staging ShadowPad implants via DLL sideloading on legit executables. Activity traces back to December 2024, but intrusions spiked this week, with nearly half overlapping a related set, SHADOW-EARTH-054, sharing tool hashes and tactics. Timeline hits hard: Monday, fresh telemetry showed Exchange mailbox compromises in transportation orgs across eight countries, leading to credential theft and prolonged access. By Wednesday, Cyfirma's weekly intel dropped bombshell on GopherWhisper, a new Chinese APT using Go-written malware to stealthily exfiltrate data from Mongolian government networks via Discord, Slack, Microsoft 365 Outlook, and file.io C2 channels. No ransomware, pure espionage on politics, diplomacy, and borders—prime for Beijing's regional plays. Thursday escalated with U.S. lawmakers, including House Select Committee on China Chairman John Moolenaar and Homeland Security's Andrew R. Garbarino, launching probes into Chinese AI firms like DeepSeek, Alibaba, Moonshot AI, and MiniMax. They're distilling U.S. frontier AI models at industrial scale, embedding censorship backdoors and security holes that risk American data. No direct CISA or FBI emergency alerts on these yet, but the patterns scream active threats: N-day exploits on legacy systems, AI model theft, and persistent footholds. Defensive actions? Patch Exchange and IIS now—those vulns are gold for attackers. Scan for web shells, enforce least-privilege on AI agents per China's own MIIT warnings, and audit logs religiously. Organizations with exposed servers face imminent breach. Escalation scenarios? If SHADOW-EARTH-053 pivots to U.S. critical infrastructure—like energy or defense contractors—we could see data dumps fueling hybrid warfare, especially with Japan already reeling from China-linked MirrorFace hitting their Ministry of Foreign Affairs, JAXA, and semis. Pair that with AI exfiltration, and it's recipe for disrupted comms or manipulated intel. Stay vigilant, listeners—run those patches, segment networks, and monitor for Go malware or anomalous C2. Thanks for tuning in—subscribe for daily drops. This has been a Quiet Please production, for more check out quietplease.ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta This content was created in partnership and with the help of Artificial Intelligence AI.