China's Hacker Glow-Up: DKnife Drama, Notepad++ Gets Dirty and Why Your Router is Probably Crying Right Now

This is your Digital Frontline: Daily China Cyber Intel podcast. Hey listeners, Ting here on Digital Frontline, your go-to gal for the pulse-pounding world of China cyber ops. Picture this: it's been a wild 24 hours in the shadows, and China's hackers are flexing hard on US turf and beyond. Buckle up—I'm diving straight into the fresh intel. First off, that sneaky DKnife toolkit from a China-nexus crew is back, hijacking Linux routers like CentOS and Red Hat boxes for adversary-in-the-middle espionage. Cyberrecaps dropped the bomb yesterday: these bad boys have been active since 2019, redirecting traffic from WeChat and email providers to slip in ShadowPad backdoors. They're DNS-jacking updates for Android apps and Windows binaries, targeting Chinese-speaking users but with clear eyes on US networks. IP 43.132.205.118 is a hot one—block it now if you're edge-exposed. Hot on its heels, Rapid7 fingered the long-running Lotus Blossom group—Chinese-linked since 2009—for hijacking Notepad++ updates. Don Ho, the dev himself, confirmed on his blog that from June to December 2025, they compromised Hostinger servers, selectively poisoning downloads for targeted victims. CISA's on it, probing US gov exposure. These espionage pros love aviation, telecom, and critical infra sectors—think East Asia interests bleeding into US supply chains. Kevin Beaumont spotted three orgs with East Asia ties hit hard. Over in Singapore, UNC3886—pure China cyber muscle—slammed critical infrastructure last week, per Opfor Journal's February 7 report. That's a screaming red flag for US allies in the Indo-Pacific, with tactics mirroring hits on our partners' grids. And don't sleep on CISA's BOD 26-02 directive: yank those EOL edge devices like old routers and VPNs within 12 months, 'cause China and Russia state actors are feasting on them for network infiltration. Targeted sectors? Dev tools, payments like BridgePay's ransomware mess (initial vector unknown but timing screams opportunistic), energy via weak VPNs—echoes of Poland's Static Tundra fail but lesson learned—and now software supply chains. Expert take from Rapid7: this is persistent gateway control for intel grabs, overlapping with Spellbinder frameworks. No massive US breaches in the last day, but the Notepad++ pivot shows they're laser-focused on devs and infra pros with US ties. Defensive playbooks, listeners: Patch SmarterMail's CVE-2026-24423 yesterday—CISA KEV-listed it for ransomware RCE. Enforce MFA everywhere, no default creds on FortiGates. Inventory edge gear per BOD 26-02, hunt DKnife IOCs, and segment dev environments. Businesses, audit npm for Shai-Hulud worms and Notepad++ installs—roll back if sus. Run EDR like your life's on it, and drill social engineering defenses; Signal hijacks are the new black. Stay frosty out there—this cyber frontline's heating up, and China's playing 4D chess. Thanks for tuning in, smash that subscribe button for daily drops. This has been a Quiet Please production, for This content was created in partnership and with the help of Artificial Intelligence AI.