China's Hacking Spree: From Fake Professors to TikTok Data Grabs - The FBI's Most Wanted List Just Got Busier

This is your Red Alert: China's Daily Cyber Moves podcast. Hey listeners, Alexandra Reeves here with your Red Alert on China's daily cyber moves. Over the past few days, it's been non-stop pressure on US targets, blending old-school espionage with cutting-edge AI tactics. Let's dive into the timeline that's got CISA and FBI lights flashing red. It kicked off last week when the Department of Justice announced the extradition of Xu Zewei, a 34-year-old Chinese national from Shanghai Powerock Network Co. Ltd., tied to China's Ministry of State Security and Shanghai State Security Bureau. Arrested in Italy back in July 2025, Xu landed in a Houston courtroom this week, facing nine counts of wire fraud, hacking, and identity theft for Silk Typhoon operations—also known as Hafnium or Murky Panda. Between early 2020 and 2021, he and co-conspirator Zhang Yu, still at large, exploited Microsoft Exchange Server flaws, planting web shells on over 12,700 US organizations, including universities hunting COVID-19 vaccines and treatments. FBI Cyber Division's Brett Leatherman called it a vast intrusion campaign straight from Beijing's playbook. Yesterday, April 28, the DOJ dropped another bomb: indictments against Song Wu, an engineer at Beijing's Aviation Industry Corporation of China—AVIC, a sanctioned state-owned giant with 400,000 employees. From 2017 to 2021, Wu ran a four-year spear-phishing marathon, spinning up fake Gmail accounts to impersonate US researchers. He sweet-talked NASA, Air Force, Navy, Army, FAA staff, and university profs into coughing up export-controlled aerospace and weapons software. Charged with 14 counts each of wire fraud and aggravated identity theft, Wu's still ghosting the FBI's most-wanted list. Then-FBI Director Christopher Wray warned back in 2024 that China's hacking program dwarfs every other nation's combined. Today, the FBI issued fresh alerts on security risks in Chinese-made apps like TikTok and Temu, flagging them as data siphons exposing personal info for foreign collection. Meanwhile, broader trends from the CyberMadness Motion and Tailwinds Report highlight AI-vs-AI warfare: adversaries like China operationalizing autonomous agents for swarming attacks, data exfiltration, and supply chain hits, per CEOs George Kurtz of CrowdStrike and Kevin Mandia of Armadin. CISA and FBI urge immediate defenses: Hunt for web shells and Exchange exploits using their latest IOCs; enforce just-in-time privileges to slash non-human identities—API keys now outnumber humans 10-to-1; deploy AI-native SOCs with agentic triage and continuous red-teaming; patch Hugging Face's CVE-2026-25874 for robotics RCE; and audit shadow AI tools bypassing controls. Escalation scenarios? If unchecked, this ramps to mass operational disruption—think agent-driven chaos hitting critical infrastructure, with PRC's cyber force matching US lethality in space and precision strikes, as Brookings notes. Boards demand resilience: Drill playbooks, measure hall This content was created in partnership and with the help of Artificial Intelligence AI.