China's Cyber Typhoon Strikes Again! Telcos, Hospitals & Govs Beware - Ting Dishes the Deets

This is your Digital Dragon Watch: Weekly China Cyber Alert podcast. Welcome to another episode of Digital Dragon Watch: Weekly China Cyber Alert. I’m Ting, your friendly cyber-sleuth, here to cut through the digital smoke and mirrors and bring you the very latest on China-related cybersecurity from the past seven days. Let’s start with the headline-grabber: Salt Typhoon is back, folks, and this time the China-linked group zeroed in on a juicy Cisco vulnerability, catalogued as CVE-2023-20198. Over the weekend, we saw coordinated attempts to breach global telecommunications providers, with a special focus on Canada. This flaw, if you missed the memos, allowed attackers to escalate privilege and deploy malware on networking gear—prime real estate for a cyber espionage operation. Cisco responded by issuing urgent patches, and both US and Canadian agencies urged telcos to update firewalls and segment their networks pronto. Meanwhile, Taiwan remains the bullseye on China’s cyber dartboard, with attacks not just multiplying—they’re practically self-replicating. We’re talking 2.4 million daily cyber attempts, with about 80% targeting healthcare and government infrastructure. One jaw-dropping case involved MacKay Memorial Hospital: a 20-year-old hacker, Lo Chengyu, alias “Crazyhunter,” launched a ransomware blitz that crippled hundreds of systems and stole over 16 million patient records. The hospital stood firm, refusing the $100,000 ransom, and security teams eventually purged the malware without paying a dime. But Crazyhunter, not one to slink away quietly, published patient names online, ramping up pressure. These hospital attacks are all part of China’s grey-zone tactics. Not outright war, but digital harassment designed to wear down Taiwan’s resilience—targeting anything from hospitals to local government tax offices. Defensive measures? Taiwan’s own agencies have upped incident response drills and deployed advanced endpoint detection and response (EDR) systems, but officials admit the onslaught is straining resources. Across the Pacific, US government cybersecurity teams are still on high alert. After the December breach of a third-party US Treasury vendor by Chinese actors, this week’s guidance leans heavily on rapid patching, supply chain scrutiny, and stronger multi-factor authentication for government contractors. And if you thought enterprises were safe, think again. More than 70 organizations globally—including manufacturing, finance, research, and IT logistics—were hit in a PurpleHaze-linked wave of Chinese espionage from July 2024 to March 2025. SentinelOne’s cyber sleuths, Aleksandar Milenkoski and Tom Hegel, found reconnaissance and mapping of internet-facing servers, probably prepping for something bigger down the line. So, what are the pro tips from the experts this week? Patch, patch, patch—especially Cisco devices. Limit internet exposure of critical systems. Double down on EDR. And above all, rehearse incident response like This content was created in partnership and with the help of Artificial Intelligence AI.