Sneaky Pandas Prowling US Telcos and Ports, Feds Sound Alarm

This is your Digital Frontline: Daily China Cyber Intel podcast. I’m Ting, and let’s jack straight into today’s Digital Frontline on China cyber intel. In the last 24 hours, US officials and major security vendors have been hammering on one core theme: Chinese state-linked groups are pivoting harder into quiet, long‑dwell espionage inside US critical infrastructure, especially telecom, cloud, and regional utilities. The new Federal Register notice titled “Protecting the Nation’s Communications Systems from Cybersecurity Threats” warns that threat activity tied to the People’s Republic of China is increasingly focusing on US communications backbones, from undersea cable landing stations to rural ISPs and 5G core systems. According to that notice, defenders should now assume that at least some Chinese activity is pre-positioning for “disruption in a crisis,” not just theft. Huntress’s threat actor profiles line up with what we’re seeing: groups like Vanguard Panda, also known as Volt Typhoon, are specializing in living-off-the-land attacks against US critical infrastructure, using built-in tools like PowerShell, WMI, and VPN appliances rather than flashy malware. Huntress also highlights Gallium, sometimes called Phantom Panda or Granite Typhoon, going after telecoms to siphon subscriber and signaling data. When you combine those tactics with what Maritime Fairtrade reports about China’s cyber posture in the South China Sea—DDoS, ICS targeting, and data theft to shape territorial disputes—you get the same playbook aimed at US maritime logistics, port operators, and energy firms tied into Pacific supply chains. Targeted sectors called out across these sources today are US communications, cloud hosting, managed service providers, and anything that touches maritime transport or energy telemetry. Think regional telcos in California or Washington, mid-size data centers in Texas, and logistics software vendors feeding port authorities. On the defensive side, the Federal Register advisory pushes very concrete guidance: tighten access to core routing infrastructure, strictly segment management networks, and rip out or harden high‑risk foreign-made network gear in core and aggregation layers. It also nudges organizations to enable secure logging to US-based SIEM or MDR partners and to continuously monitor for unusual administrator behavior rather than just malware signatures. So, practical playbook time for you and your organization. First, lock down remote access: enforce phishing-resistant MFA on every VPN, RDP, and admin portal, with conditional access policies that geo-fence logins to expected regions. Second, treat your telecom and OT connections like radioactive material: segment them, deny-by-default, and monitor East–West traffic for weird PowerShell, certutil, or netsh behavior that Huntress repeatedly flags in Chinese APT tradecraft. Third, patch internet-facing edge devices—firewalls, VPNs, load balancers—on a brutal, no‑excuses schedule, b This content was created in partnership and with the help of Artificial Intelligence AI.