Chinese Hackers Gone Wild: Abusing Security Tools, Flirting with AI, and Eyeing the Mississippi

This is your Digital Dragon Watch: Weekly China Cyber Alert podcast. Hey listeners, Ting here with your Digital Dragon Watch for the week ending October 10th, 2025. Let's dive straight into what the Chinese cyber threat landscape looked like this week, because honestly, it's been wild. So first up, we've got Storm-2603, a Chinese threat group that's been getting creative with their tactics. According to reports from SC Media and Dark Reading, these hackers are now abusing Velociraptor, which is ironically a digital forensics and incident response tool that security teams use to investigate breaches. Talk about using your opponent's weapons against them, right? They're leveraging this tool to maintain persistent access to victim networks and spread ransomware. It's like breaking into someone's house using their own locksmith tools. But here's where it gets really interesting. Security researchers at Truesec discovered another Chinese cyber espionage group that's gone full Silicon Valley on us, they're using ChatGPT to craft their attacks. These hackers are leveraging large language models to write spear phishing emails and adapt their malware. The campaign distributes a remote access tool called GOVERSHELL through trojanized documents. The funny part? The AI sometimes generates what researchers call AI slop, including useless junk files and even pornographic images that serve absolutely no purpose. OpenAI shut down their accounts, but let's be real, they'll just sign up again with a different email. Meanwhile, the FBI dropped some serious warnings about Chinese targeting of American infrastructure. Agent Benjamin Dreessen told the Louisiana District Export Council that China is specifically targeting the Mississippi River system and major ports. According to The Center Square, he stated that China is anticipating major conflict with the United States and working to interfere with the American military, induce panic, and impede decision making in the White House. Trade between New Orleans and China saw a 387 percent increase in cargo tonnage between 2014 and 2023, giving China serious exposure to critical American supply chains. On the defensive side, Hong Kong just launched their second annual Cybersecurity Attack and Defence Drill on Friday. The Digital Policy Office organized this three day, 60 hour exercise involving 25 government agencies and nine public institutions as blue teams defending against 15 red teams of cybersecurity experts from Hong Kong and mainland China. Secretary Sun Dong emphasized this is prep for major upcoming events including the 15th National Games and their Legislative Council General Election. The Senate just passed a strong national defense bill with provisions specifically targeting Chinese cyber threats, including protecting American genetic data from foreign adversaries and strengthening collaboration with allies like Taiwan on digital infrastructure defense. Thanks for tuning in to this week's Digital Drago This content was created in partnership and with the help of Artificial Intelligence AI.