China's Cyber Rampage: Microsoft & VMware Meltdown, Pentagon Bans Beijing Coders!

This is your Digital Frontline: Daily China Cyber Intel podcast. Hey listeners, Ting here on Digital Frontline: Daily China Cyber Intel, and you’re not going to want to miss what’s hit the wire in the last 24 hours. If your organization runs Microsoft, VMWare, or anything even remotely juicy to a Chinese intel operator, buckle up and pass the popcorn—let’s dive right in. Let’s start with Microsoft, because lately, being a Microsoft ecosystem is like painting a giant bullseye on your data center. Microsoft just confirmed that two Chinese state-linked groups, Linen Typhoon and Violet Typhoon, popped open unpatched SharePoint servers across the US, UK, and beyond—government, healthcare, education, and big enterprise, all on the menu. There’s not even time for a fortune cookie before ransomware crews like Storm-2603 join in, trying to leverage the same weaknesses and lock up your data. Microsoft is scrambling with emergency patches, but if your SharePoint is on-prem— that is, not in the cloud—you need to patch yesterday, not tomorrow. Remember: SharePoint Online is, for now, unaffected. Why the feeding frenzy? SharePoint on-prem went unpatched in too many orgs. Experts at Palo Alto Networks and Eye Security reported over 400 organizations hit in days, including, per the latest media reports, the US nuclear weapons agency. This is stuff that makes security teams sweat bullets. To the genius who still uses default passwords, consider yourself on China’s VIP list. Meanwhile, if you've got a VMware deployment anywhere, congratulations, you just made Fire Ant's highlight reel. This Chinese APT group, tracked as UNC3886 by Mandiant and Sygnia, has been tunneling into US network infrastructure by exploiting vCenter and ESXi vulnerabilities—specifically CVE-2023-34048 and CVE-2023-20867, which let them run code and move laterally, right under the nose of traditional security tools. They’re not amateurs—these folks set up persistence, rotate toolkits, and even study forensic timelines like they're prepping for an exam. Here’s the real kicker: according to ProPublica, the Office of the Director of National Intelligence has just labeled China “the most active and persistent cyber threat to US Government, private-sector, and critical infrastructure networks.” A bombshell report shows Microsoft actually relied on engineers in China for the DOD’s cloud maintenance, with digital escorts stateside not fully grasping the code being delivered. That arrangement ended literally yesterday after Defense Secretary Pete Hegseth went public, banning any Chinese involvement and ordering a Pentagon-wide review. Turns out sometimes, the backdoor isn’t even a hack—it’s just a hiring decision. So what should you do now? Here’s the lightning round: Patch every SharePoint and vCenter exposure—no excuses. Audit VMware systems for indicators of compromise; look for odd PowerCLI activity and rotated toolsets. Enforce strong, unique credentials everywhere. Ban default passwords l This content was created in partnership and with the help of Artificial Intelligence AI.