China's Cyber Surge: ToolShell Madness, AI Smishers, and Taiwan Tensions Flare!

This is your Red Alert: China's Daily Cyber Moves podcast. Hey listeners, it’s Ting—your resident cyber sleuth and watcher of all things digital lurking east of the Great Firewall. No time to waste, because this week, Red Alert means business: China’s cyber operators have turned the dial up, and the targets? U.S. critical infrastructure, tech, and—thanks to ToolShell—a whole new set of gov networks. Let’s unpack what’s lighting up the threat boards right now. Flashback to this Monday: the infamous ToolShell vulnerability, aka CVE-2025-53770, was patched by Microsoft ten days ago. Guess what? Symantec’s Threat Hunter Team and Trend Micro confirm that within forty-eight hours, Chinese groups like Glowworm and UNC5221 pounced. Mass scanning happened worldwide, but the real focus went to U.S. universities and tech agencies, plus telecom and government bodies in the Middle East, Africa, and South America. Glowworm and buddies dropped backdoors like Zingdoor and KrustyLoader, piggybacking off totally legitimate Trend Micro and BitDefender binaries to hide in plain sight. These folks didn’t just stay for coffee—they set up persistence, dumped credentials, and siphoned off data, using a who’s who of “living-off-the-land” tactics: PowerShell, Certutil, Minidump, the works. Just as my VPN pinged Taiwan, Trellix Advanced Research Center (whose CyberThreat Report dropped this week) flagged a surge in activity tied to Chinese APTs in April—right as the Shandong carrier group danced into Taiwan’s Air Defense ID zone. Coincidence? Hardly. Trellix now reports 540,974 detections across 1,221 unique campaigns, with the U.S. account for 55% of victims. The big story is convergence: state-backed espionage meets hard-nosed financial motivation, supercharged by AI. Forget just ransomware. XenWare—the first fully AI-crafted ransomware—appeared in April, encrypting everything with multithreading muscle. At the same time, the LameHug AI-powered infostealer is running wild, filching credentials and adapting its phishing tricks on the fly. Turns out, the fragmentation of the ransomware scene is good news (sort of) for defenders—no single player dominates. But the industrial sector’s feeling the worst of it, and, as The Hacker News warned today, Chinese crews are hammering U.S. critical infrastructure, mostly targeting old, unpatched, forgotten network hardware—think ancient VPNs, dusty routers, and firewalls long since abandoned by IT staff. CISA, joined by the FBI, issued an emergency alert this morning: patch the perimeter, audit network devices, and check for “mantec.exe”—a nasty little loader pretending to be Symantec but packing KrustyLoader or ShadowPad. Active threats right now include a resurgence in living-off-the-land tactics. Salt Typhoon, another Chinese threat group, is blending in with regular network traffic, making detection that much harder. Meanwhile, the Smishing Triad just hit another milestone: over 194,000 malicious domains used for SMS phishing, This content was created in partnership and with the help of Artificial Intelligence AI.