Ting Sounds the Alarm: Chinese Hackers Are Rehearsing on Foreign Soil Before Coming for US Networks

This is your Red Alert: China's Daily Cyber Moves podcast. Hey listeners, Ting here, your friendly neighborhood China-and-cyber nerd, and I’m hitting the red alert button right away. Over the past few days, the most serious Chinese cyber storyline for US defenders is about three things: stealthy infrastructure hacks, zero‑day engineering, and cognitive warfare drifting closer to home. First, let’s talk hands-on-keyboard. SecurityWeek and other industry outlets report that China‑linked operators, tracked as UAT‑7290, have been quietly targeting telecom networks using custom Linux malware and ORB proxy nodes. These campaigns have hit South Asia and Southeastern Europe, but US telecom and cloud backbones use the same classes of edge devices and Linux appliances, so treat this like a dress rehearsal on someone else’s stage for a show that can move to the United States overnight. Next, the VMware ESXi situation. Huntress and The Hacker News report that Chinese‑speaking threat actors used a compromised SonicWall VPN as initial access to drop a VMware ESXi exploit toolkit that appears to have been developed as early as February 2024, long before public disclosure. That toolkit enables virtual machine escape, which means an intruder sitting in one guest can potentially pivot into the hypervisor and other tenants. For any US government contractor, defense industrial base shop, or cloud‑heavy enterprise, that’s nightmare fuel. Timeline this out: by early 2024, the exploit kit exists. Through 2025, it’s quietly refined. In December 2025, Huntress catches an attempted campaign and cuts it off before likely ransomware deployment. Roll into the past few days, and multiple threat feeds like ThreatABLE are still flagging “China‑Linked Hackers Exploit VMware ESXi Zero‑Days” as an active, not historical, concern. So this isn’t a museum piece; it’s a live tool in the Chinese playbook. On the defensive side, CISA just retired 10 older emergency directives, according to BleepingComputer and CISA summaries, but don’t let that sound comforting. In the same time window, CISA added an old Microsoft Office code injection bug and an HPE OneView flaw to the Known Exploited Vulnerabilities catalog, with explicit warning that they’re being hit in the wild. Pair that with a China‑nexus actor already proven willing to chain SonicWall VPN bugs and ESXi zero‑days, and you have an obvious escalation path: edge device → management appliance like HPE OneView → hypervisor → everything. Meanwhile, Taiwan’s National Security Bureau, as reported by the Taipei Times, is documenting a surge of China’s AI‑powered cognitive warfare, including millions of disinformation pieces and botnets operating in over 20 languages across 180 platforms. That same toolset can be spun against US elections, defense debates, and support for Taiwan on very short notice, blurring the line between classic hacking and opinion‑space hacking. So, what should US defenders be doing right now? Patch or segmen This content was created in partnership and with the help of Artificial Intelligence AI.