Salt Typhoon Sinks Its Teeth In: US Orgs Scramble as Chinese Hackers Go Big

This is your Digital Dragon Watch: Weekly China Cyber Alert podcast. Ting here, and you are tuned in to Digital Dragon Watch: Weekly China Cyber Alert. If you blinked this week, you missed another wave of China-infused cyber intrigue. So buckle up: here’s what hit the wires, what rattled the routers, and what the wonks say we should do next. Let’s start with the headline act—Salt Typhoon. This isn’t your garden variety phishing expedition. According to CYFIRMA, Salt Typhoon’s campaign, freshly outed by a joint US-UK-Canada and friends statement, was so wide-reaching it may have swept up data on nearly every American. Sectors nailed? Telecoms, transport, lodging, government, military, you name it. The technical playbook here included sophisticated lateral movement and long-term infiltration of core infrastructure networks. This wasn’t just about stealing—think surveillance, pre-positioning for disruption, and good old-fashioned intelligence collection. Salt Typhoon isn’t acting solo, either; the campaign is linked to Chinese tech firms allegedly tied tight with the People’s Liberation Army and the Ministry of State Security. While that was sending critical infrastructure operators digging through their logs, APT41 pulled a page out of the social engineering playbook. During the July trade talks, Chinese hackers impersonated a China committee chair to slip malware into inboxes at US law firms, trade bodies, and government agencies. Their goal? Trade negotiation advantage via dirty digital tricks. There’s still no word if anyone clicked, but the malware toolkit was textbook APT41, infamous for blending espionage with a dash of cybercrime. Meanwhile, the US government is on edge. Congress is scrambling to reauthorize the Cybersecurity Information Sharing Act (CISA) of 2015, as the backbone of how industry and Uncle Sam swap threat data is set to expire at the end of September. According to Just Security, letting CISA 2015 sunset now, just as Chinese espionage shifts from economic mayhem to potentially infrastructure sabotage—think Volt Typhoon burrowing into US energy networks—could send the US back to the pre-2015 dark ages of finger-pointing and siloed threat intelligence. You want attacks like SolarWinds, OPM, and Anthem on repeat? Because that's how you get them. On the flip side, China’s Foreign Ministry claims it’s the aggrieved party, announcing at a press conference that over 600 APT attacks targeted their institutions in 2024. They’re pointing fingers at the US and its allies, alleging that attacks routed through hubs like Germany, Singapore, and the Netherlands. Now, blame games aside, both sides are ramping up defensive frameworks—China just rolled out new PBOC Measures requiring rapid incident reporting and tougher data controls in banking and finance, aiming to set a national standard for cyber hygiene. For those running digital defenses in the West, here’s expert advice: close those visibility gaps. Prioritize monitoring of teleco This content was created in partnership and with the help of Artificial Intelligence AI.