Salt Typhoon Sizzles: China's Cyber Chaos Sweeps Globe, Feds Scramble

This is your Red Alert: China's Daily Cyber Moves podcast. Power up your VPNs and patch those gateways, listeners—it’s Ting here, serving up an expert byte of news hotter than a freshly minted zero-day! If you thought China’s cyber playbook was getting stale, think again. Over just the past few days—right up to today, August 31, 2025—we’ve seen Red Alert-level activity lighting up dashboards from Washington to Amsterdam. Grab your caffeinated beverage and let’s decrypt what’s happening. First off, Salt Typhoon—you know, the Chinese cyber group CISA, FBI, and NSA have been yelling about? Turns out their campaign against US telecoms, revealed last year, was the tip of the silicon iceberg. FBI Assistant Director Brett Leatherman just confirmed that breaches are global and way deeper than anyone guessed, spanning eighty countries and targeting critical sectors from transportation to military infrastructure. These attacks trace back to companies like Sichuan Juxinhe and Beijing Huanyu Tianqiong, apparently moonlighting for the People’s Liberation Army. So if you’re routing sensitive calls, assume your metadata’s already sipping Oolong tea in Chengdu. The timeline’s been bonkers: on August 27, NSA and global partners dropped a joint alert spelling out targeted vulnerabilities, and CISA has updated its Known Exploited Vulnerabilities catalog twice since then. What’s on the list? Biggies like CVE-2024-21887 in Ivanti Connect Secure, the now-infamous Palo Alto PAN-OS CVE-2024-3400, not to mention Cisco IOS XE RCE classics and yes, Citrix NetScaler’s own CVE-2025-7775, actively exploited on more than 28,000 instances. Shadowserver Foundation reported mass scanning activity, and CISA issued emergency patch guidance—if you haven’t deployed, you’re inviting a Salt Typhoon housewarming party. Meanwhile, threat actors linked to UNC6395 snagged OAuth tokens in a Salesloft breach, opening backdoors to Drift AI chat platforms. Mandiant and Google flagged this as a coordinated campaign, likely sponsored by those same state-backed groups. On the consumer end, WhatsApp scrambled to patch CVE-2025-55177—a zero-click spyware bug targeting iOS and macOS. No more innocent group chats from Guangzhou to San Fran. Let’s talk escalation. CISA and FBI say we are moving into more destructive territory. What starts as espionage—snagging telecom metadata, hijacking VPNs—can shift fast to sabotage. Analysts like Ciaran Martin warn these capabilities let China track comms and even disrupt infrastructure at scale. Imagine Salt Typhoon staging ransomware on backbone routers or AI-assisted identity theft surging from data siphoned in last week’s breach. So what do you do, fellow tech warriors? Patch immediately—Ivanti, Citrix, and Palo Alto gear first. Segment your networks, check logs for SSH on weird ports, and hunt for shady GRE tunnels. Treat any OAuth tokens as compromised if your platforms integrate with Salesloft or Drift. Run tabletop exercises, tighten privilege contro This content was created in partnership and with the help of Artificial Intelligence AI.