Ting's Tea: China's Mustang Panda Steals Browser Cookies While Salt Typhoon Taps Downing Street's Phones

This is your Digital Frontline: Daily China Cyber Intel podcast. Hey listeners, Ting here on Digital Frontline, your daily dive into China's cyber chess moves against US turf. Buckle up—past 24 hours dropped some scorcher intel that's got me grinning at the predictability while sharpening my virtual katana. Fresh off the wire, Mustang Panda—that sly China-linked APT crew, aka Earth Preta or Twill Typhoon—rolled out an upgraded COOLCLIENT backdoor in 2025 ops, but echoes hit US-adjacent radars today via The Hacker News reports. They're snagging keystrokes, browser creds from Chrome and Edge, even Firefox cookies via cURL to Google Drive, hitting Asian govs and telecoms in Myanmar, Mongolia, Malaysia, and Russia. Think reverse tunnels, rootkits, and TONESHELL persistence—pure espionage gold for prepping data heists that could bleed into US supply chains. Sectors? Telecoms and government top the list, with Broadcom's Symantec flagging long-haul campaigns since 2021 mirroring Salt Typhoon's global telecom breaches. Speaking of Salt Typhoon, The Telegraph just accused them of burrowing into Downing Street phones from 2021-2024, nabbing texts, calls, and metadata from aides under Boris Johnson, Liz Truss, and Rishi Sunak. US intel ties it straight to Beijing, and Anne Neuberger warned they can record calls at will. This spills over to US interests—Five Eyes shared the pain, and with Sir Keir Starmer eyeing a Beijing trip amid London's mega-embassy drama near telecom hubs, it's a neon sign for Yankee defenses. Alicia Kearns slammed the UK's "simpering" to Xi Jinping, but China's embassy denies it all, calling it politicized noise. Expert take? Matthew Ferren from Council on Foreign Relations warns in HSToday that Trump's brewing offense-first cyber strat—think hacking back—won't dent China's beast-mode ecosystem. They regenerate ops like hydra heads for espionage, tech theft, and crisis pre-positioning. CISA's getting gutted on staff and funds, per Ferren, while Check Point's 2026 Report notes China-nexus crews syncing hacks to geopolitics, blending state and crime for global reach. US-Taiwan AI-supply chain pact today underscores the heat, countering Beijing's Nvidia chip imports during Jensen Huang's visit. Targeted US sectors: defense firms like Northrop Grumman, Boeing St. Louis, L3Harris—hit by China's Dec 2025 AFSL sanctions over Taiwan arms sales, per JD Supra. Biosecure Act looms mid-2028 to block biotech ties. Defensive playbooks, listeners: Patch like your life's on the line—DLL side-loading's their jam, so audit signed binaries from Sangfor or VLC masquerades. Enable MFA everywhere, hunt for JScript C2 frameworks like PeckBirdy hitting Asian govs per Dark Reading. Segment telecom nets, monitor HTTP proxies for COOLCLIENT beacons, and harden First Island Chain bases with Deptula's passive defenses—reinforced hangars, deception ops. Businesses, tighten breach notices to 30 days California-style, audit "significant risks" per new state rul This content was created in partnership and with the help of Artificial Intelligence AI.