China's Decade-Long Sleepovers and Why Your Hospital Database is Basically a Spy Novel Now

This is your China Hack Report: Daily US Tech Defense podcast. Hey listeners, Ting here, your resident China-and-cyber nerd, and today’s China Hack Report is…busy. Let’s start with the most surgical stuff: according to ESET researchers, two new Windows variants of the SprySOCKS backdoor just dropped into the wild, tied to the China-linked FishMonger group, which is believed to work with Chinese contractor I-SOON. This malware gives long-term stealthy access, and it’s no longer just a Linux party. If your endpoints in defense, research, or telecom are still treating “Windows-only” as a comfort zone, that bubble just popped. Lock down PowerShell, tighten EDR detections around unusual socket behavior, and do not ignore weird outbound traffic from so-called “utility” servers. Zooming out, a long-running espionage operation called Operation Highland has been linked to the Chinese threat group Velvet Ant, who reportedly camped inside a large organization’s network for nearly a decade, quietly exfiltrating data. Think about that: multiple US-facing networks could be bleeding IP and defense-adjacent intel for years. This is the Zero Trust wake-up call of the week—assume compromise, continuously verify, and segment your crown jewels like you’re allergic to flat networks. In healthcare and research, analysts report that a China-linked group tracked as UNC6508 went after vulnerable REDCap servers at a North American medical research institution for more than a year, dropping custom malware and stealing sensitive research data. If you’re running REDCap or similar platforms on the US health or bio-research side, patch yesterday, restrict access to VPN or SSO, and slap a proper WAF in front. Clinical trial data and genomic research are now geopolitical assets. On the more public-facing front, US authorities just dismantled Outsider Enterprise, a Chinese phishing-as-a-service network pumping out AI-powered phishing kits and fake websites to steal credit cards and credentials, and the Department of Justice shut down 13 China-linked espionage sites posing as consulting firms to target current and former US government employees with clearances. Treat every “we love your résumé” email from a mystery consulting shop as a potential intelligence op—verify through independent channels before you click anything. CISA and partners are actively warning about exploitation of a laundry list of enterprise bugs: Fortinet devices, Cisco SD-WAN, LiteSpeed plugins, Ivanti Sentry, Oracle PeopleSoft, Splunk, Palo Alto GlobalProtect, and more. These are exactly the footholds nation-state actors, including China-linked crews, love to chain together. Prioritize emergency patching on edge devices and identity infrastructure first, then everything tied to remote access or logs. And yes, that includes the “we’ll fix it next sprint” VPN gateway in the forgotten rack. Immediate defensive homework for you: enable MFA everywhere, monitor for new service accounts and unexpected remote access tools, hunt for long-lived persistence like scheduled tasks and rogue DLLs, and rehearse your incident response so you’re not Googling “what is a tabletop exercise” while Velvet Ant is already in your backups. I’m Ting, thanking you for tuning in. Don’t forget to subscribe so you never miss your daily China Hack Report: Daily US Tech Defense. This has been a quiet please production, for more check out quiet please dot ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta