Chinese Hackers Are Basically Living in Your Cloud Right Now and Nobody Noticed for Months

This is your Cyber Sentinel: Beijing Watch podcast. Hey listeners, Ting here with Cyber Sentinel: Beijing Watch, and this week in Chinese cyber activity has been…busy. Let’s start with the freshest move: Google’s Threat Analysis Group reports a long-running espionage campaign by a China‑linked group targeting research institutions and think tanks focused on U.S. national security and advanced tech. Google says this crew used highly tailored phishing, spoofed conference invites, and malware‑laced “policy draft” attachments to quietly sit inside email and cloud accounts for months at a time. The aim: grab intellectual property and policy deliberations before they ever become public, giving Beijing a strategic preview of U.S. moves. On the tradecraft side, analysts at Google and Mandiant note an uptick in living‑off‑the‑land techniques inside U.S. networks: Chinese operators are leaning harder on built‑in Windows tools like PowerShell and WMI, and abusing legitimate remote‑management platforms, so their activity looks like normal admin work instead of an intrusion. Pair that with cloud‑first targeting—hitting Microsoft 365, Google Workspace, and Git repositories—and you’ve got campaigns that bypass a lot of old-school perimeter defenses. Industry-wise, this week’s spotlight is on U.S. defense contractors, semiconductor firms, and energy infrastructure. Google’s reporting on the research‑sector campaign highlights interest in AI, quantum, and hypersonics, exactly the tech that feeds military modernization. In parallel, U.S. officials and private telemetry point to Chinese probing of operational technology in power and pipeline operators, not to blow anything up today, but to pre-position for crisis leverage later. Attribution is getting stronger. According to Google’s public briefings, infrastructure, malware families, work hours, and tasking lines all tie back to known Chinese state-aligned clusters historically tracked as APT31 and APT41. The timing of specific tasking often lines up with policy events in Beijing, which is one reason U.S. and allied agencies are increasingly comfortable calling these campaigns Chinese state-directed espionage rather than freelance crime. Internationally, Washington is not alone. News outlets like WION and regional media describe Beijing trading accusations with Taipei in an escalating cyber confrontation, and European governments have joined the U.S. in coordinated attribution and sanctions in previous Chinese campaigns, setting a precedent for more joint responses if this tempo continues. So what should U.S. organizations actually do? Technically: enforce phishing-resistant multi-factor authentication, lock down admin accounts, and enable strict logging in cloud platforms. Hunt for anomalous use of PowerShell, WMI, and remote management tools, not just classic malware. Patch external-facing services fast and segment networks so research, OT, and corporate IT aren’t one big flat playground. Strategically: treat China-linked cyber espionage as a continuous intelligence contest, not isolated incidents. Boards need China risk on the agenda, red‑team exercises against Chinese TTPs, and tight sharing with CISA, FBI, and sector ISACs. That’s it for this Beijing Watch. Thanks for tuning in, listeners, and don’t forget to subscribe so you don’t miss the next briefing. This has been a quiet please production, for more check out quiet please dot ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta