Phantom Taurus Pivots Prowess as Salt Typhoon Shakes Up Telecoms in Epic China Hacks

This is your Digital Dragon Watch: Weekly China Cyber Alert podcast. Hey listeners, it’s Ting here, your cyber sage bringing you the freshest from Digital Dragon Watch—and let me just say, this week in China cyberland wasn’t dull, unless your definition of excitement is watching router logs scroll by at 3 a.m. Let’s kick off with the headline-grabber: Phantom Taurus. Imagine the APT scene as a crowded noodle bar and Phantom Taurus walks in, orders off-menu, and pays with cryptocurrency. According to Palo Alto Networks and InfoSecurity Magazine, Phantom Taurus has been hammering away at government and telecom sectors in Africa, the Middle East, and Asia for over two years—think embassies, ministries of foreign affairs, and military networks. What’s wild is their pivot: formerly all about email theft, now moving straight for SQL Server databases with custom batch scripts and WMI remote execution. They use living-off-the-land techniques, blending in with normal system activity so well it’s like they’re wearing camouflage in cyberspace. One step further, their shared infrastructure with groups like Iron Taurus and Mustang Panda hints at a professional cyber-espionage ecosystem, but Phantom Taurus tweaks their tactics—unique operational signatures, different malware like Specter, Net-Star, and Ntospy. Basically, they stay undetected and persistent, making defenders sweat bullets while sifting through logs for months. If you thought that was spicy, let me introduce Salt Typhoon, uncovered by GBHackers. Salt Typhoon has been exploiting network edge devices since 2019—routers, VPN gateways, firewalls—across U.S., U.K., Taiwan, and EU, especially telecom providers and even National Guard networks. These guys use sophisticated firmware implants to grab VoIP configs and lawful intercept logs, sometimes with help from pseudo-private contractor firms like i-SOON. Yes, we’re talking full-on Ministry of State Security (MSS) coordination, subcontracting technical tasks for deniability. Recent joint indictments named operators like Yin Kecheng and Zhou Shuai. Their tradecraft? Registering domains with fake U.S. personas and using off-the-shelf certificates to look legit. It’s industrialized cyber espionage—think modularity and scalability that’d make Silicon Valley jealous, if it weren’t aimed squarely at American infrastructure. Of course, the U.S. government didn’t just stand around, playing Minesweeper. The FCC, led by Brendan Carr, started proceedings to boot seven China-controlled electronics testing labs, thanks to their new "Bad Labs" rules. This is part of a broad effort to kick foreign adversaries out of the device certification game. In Congress, Ted Cruz and Michael Baumgartner rolled out the SANDBOX Act: regulatory sandboxes for AI so U.S. firms can outpace China. And let’s not forget the Trump administration’s executive order to cleave TikTok’s U.S. operations from ByteDance, with Oracle wrangling U.S. data. On the defensive side, experts like This content was created in partnership and with the help of Artificial Intelligence AI.