China's Cyber Rampage: Ransomware Gangs, AI Theft, and a Hacker Who Robbed Beijing's Own Supercomputer

This is your Red Alert: China's Daily Cyber Moves podcast. Look, we're watching something unprecedented unfold across the cyber landscape right now, and if you're not paying attention to what China's been doing over the past seventy-two hours, you should be. Let me walk you through the critical timeline. On April sixth, Microsoft dropped a security report on Storm-1175, a financially motivated Chinese threat actor that's been active since at least twenty twenty-three. These aren't state-sponsored operators in the traditional sense, but they're weaponizing vulnerabilities faster than our defensive teams can patch them. We're talking hours, not days. Storm-1175 has been deploying Medusa ransomware across healthcare systems, education institutions, professional services firms, and financial networks in Australia, the United Kingdom, and here in the United States. They're exploiting both zero-day vulnerabilities and known n-day flaws simultaneously, which means they're hitting systems through internet-facing applications and then using legitimate administrative tools to blend in and evade detection. The scope gets worse when you look at what Anthropic published back in February. Three Chinese AI laboratories—DeepSeek, Moonshot AI, and MiniMax—created roughly twenty-four thousand fraudulent accounts to run over sixteen million unauthorized exchanges with Claude. MiniMax alone accounted for thirteen million of those exchanges. They were systematically stealing AI model outputs to train cheaper alternatives. DeepSeek was particularly sophisticated, using Claude to actually build censorship capabilities for the Chinese government. That's not just corporate espionage anymore. That's infrastructure weaponization. Now layer on top of this what happened at the National Supercomputing Center in Tianjin. A hacker calling themselves FlamingChina allegedly breached one of China's own supercomputers and stole over ten petabytes of sensitive data. We're talking classified defense documents, missile schematics, aerospace engineering research, military simulations. The attacker claimed they gained access through a compromised VPN domain, deployed a botnet, and extracted ten petabytes over approximately six months without detection. Cyber experts who reviewed samples believe the leak is genuine. The defensive posture here is critical. Organizations need to treat every new perimeter vulnerability as an emergency. Patch immediately. Limit remote management tool usage. Watch for unusual administrative activity. The velocity of these operations means the window between disclosure and exploitation has collapsed entirely. What we're witnessing is a shift from isolated attacks to industrialized, systematic cyber operations. The threat environment has fundamentally changed. Storm-1175 isn't slowing down. If anything, we're seeing acceleration. Thanks for tuning in, listeners. Make sure to subscribe for daily threat briefings. This has been a quiet please production, f This content was created in partnership and with the help of Artificial Intelligence AI.