Digital Dragon Dish: Hacks, Leaks, and Cyber Sneaks—China's Spicy Secrets Exposed!

This is your Digital Dragon Watch: Weekly China Cyber Alert podcast. Welcome to the latest Digital Dragon Watch: Weekly China Cyber Alert. I'm Ting—your cyber-sleuth, data defender, and guide through the wild maze of China-linked cyber drama. No fluff, just facts: let’s jump into this week’s biggest hits and hacks. The most jaw-dropping incident still sending shockwaves is the newly disclosed China Data Breach of 2025. This monster breach exposed a staggering 4 billion user records. Think about that: WeChat chats, Alipay transactions, and mountains of financial data—wide open to the world. Security researcher Bob Dyachenko and the Cybernews team found a 631-gigabyte trove sitting in the digital wilderness with zero password protection. The leak, first discovered on May 19 and publicly revealed in June, is unprecedented in scale and raises big questions about the security protocols (or lack thereof) at Chinese data repositories. If you’re picturing your favorite Chinese apps—you’re probably included in this breach. Now, let’s shift from accidental exposure to deliberate infiltration. SentinelOne, the American cybersecurity firm, revealed it fended off attacks from China-linked groups known as PurpleHaze and ShadowPad—names that sound like rejected Marvel villains but are anything but a joke. Over 70 organizations were hit in a campaign stretching from July 2024 to March 2025. Victims span manufacturing, government, finance, telecom, and research. One wild detail: attackers got in via SentinelOne’s own IT hardware supplier. The hackers could have turned freshly shipped laptops into cyber-Trojan horses, harvesting employee data and location details before the boxes were even opened. The threat actor behind this—attributed with high confidence to Chinese espionage operations, notably APT15 and UNC5174—used sophisticated reconnaissance tactics. They mapped internet-facing servers, evaluating for later attacks. This wasn’t a smash-and-grab; it was careful surveillance, prepping for a bigger heist. If you think telecom is safe, think again. The group Salt Typhoon, also known as RedMike, recently targeted five major telecom providers globally—including two in the United States. Their favorite tools: exploiting unpatched Cisco edge devices using zero-day vulnerabilities (CVE-2023-20198 and CVE-2023-20273). These exploits gave them root access, letting them go wherever they pleased on the victim networks. Salt Typhoon even extended its sights to U.S. universities like UCLA and Loyola Marymount. How’s the U.S. government responding? Detection and disclosure are top priority. Federal entities are pushing urgent alerts on Cisco vulnerabilities and working with private sector partners to hunt for persistent threats. But experts like Aleksandar Milenkoski at SentinelOne hammer home the basics: patch early, audit supply chains, lock down exposed interfaces, and monitor for unusual traffic. So, what should you do? Update your systems yesterday, especially This content was created in partnership and with the help of Artificial Intelligence AI.