China's Hackers Flex Hard: Defense Contractors Hit, AI Tools Leak Code, and LV Gets Slapped for Data Breaches

This is your Digital Dragon Watch: Weekly China Cyber Alert podcast. Hey listeners, Ting here with your Digital Dragon Watch: Weekly China Cyber Alert, diving straight into the hottest chaos from the past seven days ending February 15, 2026. Buckle up—China's hackers are flexing hard, turning cyber into a multiplayer deathmatch. First off, Google's Threat Analysis Group and Mandiant dropped a bombshell: Chinese APT5, aka Keyhole Panda or Mulberry Typhoon, alongside UNC3236 Volt Typhoon and UNC6508, are slamming the global defense sector. They're wielding custom malware like INFINITERED, ARCMAZE obfuscation, and REDCap exploits at US research institutions, plus sneaky Operational Relay Box networks to blend malicious traffic with legit stuff. Targets? North American defense contractors, supply chains, edge devices in aerospace, semiconductors, energy, and battlefield tech. Espionage goldmine, stealing IP and credentials while we sleep. Rescana's report nails it—these ops converge with Russian Sandworm, North Korean Lazarus, and Iranian Nimbus Manticore for a full-spectrum beatdown on the defense industrial base. Not stopping there: Schneier on Security flagged AI coding assistants—used by 1.5 million devs—secretly shipping every line of code they touch straight to China. Dated February 2, but the fallout's rippling now. And Chinese gov-linked hackers Trojaned Notepad++ on February 5, dropping malware on select users. Supply chain sabotage at its sneakiest. Over in Singapore, the Cyber Security Agency revealed UNC3886—China-nexus APT—breached all four major telcos: M1, SIMBA Telecom, Singtel, and StarHub last year, but probes deepened into 2026, hitting critical infrastructure. Help Net Security confirms it spurred a massive defense op. Stateside, SecurityWeek notes ongoing China threat actor attacks amid Russia, NK, Iran crews. New vectors? AI-driven recon, edge device exploits, ORBs evading geofencing, and SaaS weak spots—echoed in Washington's AI security freakout per Brussels Morning, where DHS warns of adaptive malware hitting finance, elections, defense. No direct US gov response named this week, but Anthropic's Dario Amodei slammed Nvidia's China chip push, calling it like handing nukes to bad actors. Expert recs from Mandiant and Rescana: Layer up with EDR spotting obfuscated payloads, segment networks, audit edge devices and supply chains, validate job offers (Dream Job scams everywhere), hunt for Google Forms/WhatsApp malware drops, train staff on phishing/vishing, and enable IP allow-lists, MFA, log monitoring. Defense peeps, threat hunt like your drones depend on it. Luxury alert: Louis Vuitton, Dior, Tiffany Korean subs fined $25M by PIPC for SaaS breaches—malware, phishing, vishing stole millions of customer records due to no IP controls or bulk download limits. ShinyHunters vibes, but China angle looms in the broader SaaS hunt. Listeners, stay vigilant—dragons don't sleep. Thanks for tuning into Digital Dragon Watch! Subscrib This content was created in partnership and with the help of Artificial Intelligence AI.