China's Hacking Spree: 70 Orgs Targeted, Is Your City Next?

This is your Digital Frontline: Daily China Cyber Intel podcast. Hey cyber sleuths, Ting here, coming at you with your Daily China Cyber Intel for June 14, 2025. You want the latest on China’s cyber maneuvers targeting US interests? Let’s plug in. First, today’s headline: SentinelOne, the cybersecurity firm that prides itself on hunting threats, found itself turned into prey this week. Chinese government-backed hackers, namely the threat actor clusters dubbed PurpleHaze and ShadowPad, tried breaking into SentinelOne’s defenses. Their methods? Classic reconnaissance—scanning and mapping internet-facing servers, likely eyeing vulnerabilities for future entries. While the SentinelOne breach attempt failed (well done, by the way!), it ripped open a bigger story: these hackers haven’t been limiting themselves to one trophy, but have cast a net over more than 70 organizations since July 2024. Yes, seventy. And it’s not just IT vendors—think manufacturing, telecommunications, energy, healthcare, finance, even research and food logistics. If you’re connected, you’re a candidate. SentinelOne’s ace researchers, Aleksandar Milenkoski and Tom Hegel, pointed out a connection between this spike and the notorious Chinese espionage units we’ve heard about—APT15 and UNC5174 in particular. PurpleHaze, for those new to the name, specializes in stealthy initial access and careful prep, often blending legit admin tools into their operations. ShadowPad, meanwhile, is the malware toolkit from Beijing you never want to find lurking in your systems. Not to be outdone, Chinese-speaking hackers have also been exploiting vulnerabilities in Cityworks, a critical software platform keeping American local governments running. Yes, that means cities and municipalities across the US are walking around with potential backdoors. Someone tell the mayor. What’s the endgame here? Well, China’s cyber campaigns advance both intelligence gathering and disruption objectives. Remember the Treasury Department hack in December? That one was laser-focused on economic offices responsible for sanctions targeting Chinese companies. Each move here is about undermining US economic competitiveness, sabotaging military logistics, and ensuring that, if things heat up over Taiwan, Uncle Sam’s response is slowed down. So, what to do if you’re part of an American org or run infrastructure? Here are my quick recommendations: - Audit your internet-facing assets—know what’s out there and close doors fast. - Patch, patch, patch, especially for widely used tools like Cityworks. - Zero Trust is not a buzzword—it’s now your umbrella. - Assume that even your vendors can be weak points. Vet them. Monitor them. - Get incident response plans in place BEFORE you need them. Chaos is a bad time to brainstorm. Final thought: As China’s cyber apparatus grows more ambitious and coordinated, expect the targets to shift rapidly—if you’re feeling left out today, that could change tomorrow. Stay sharp, keep your logs This content was created in partnership and with the help of Artificial Intelligence AI.