Untouchable Law Firms Hacked: Chinas Cyber Spies Exploit Gov Shutdown Chaos

This is your Red Alert: China's Daily Cyber Moves podcast. Ting here—and if there’s one thing you know about me, it’s that my screensaver says “Trust no .cn” and my coffee is always freshly brewed for an all-nighter tracking China’s cyber moves. So, let’s dive straight into today’s Red Alert. Let’s start at the heart of Washington, where the FBI’s top cyber agents are sweating over the latest “zero-day” attack, apparently courtesy of a skilled Chinese team known for targeting places most Americans would just call “untouchable.” We’re talking Williams & Connolly—the law firm for everyone from Bill and Hillary Clinton to Fortune 50 megacorps. This breach wasn’t your grandma’s phishing scam; attackers exploited a previously unknown software vulnerability, grabbed a toe-hold in attorney email accounts, and started rummaging for strategic info. There’s no evidence—yet—of client data exfiltration, but the fact that CrowdStrike and Norton Rose Fulbright were flown in for digital triage should tell even the casual listener that this is DEFCON 2 stuff. Oh, and the scope? Over a dozen other firms and tech companies, all swept up in what looks like an ongoing Chinese campaign for intelligence on U.S. national security and trade. Here’s how the timeline looks: attacks began to spike after the consequential government shutdown on October 1, 2025, which forced CISA—the Cybersecurity and Infrastructure Security Agency—to send two thirds of their cyber defenders home. This is basically inviting adversaries like APT groups linked to China to come taste-test America’s digital defenses. With only a skeletal crew left, CISA’s real-time response is crippled, and—adding insult to injury—a key information-sharing law quietly expired, hampering public-private collaboration. Now, the attack patterns are mutating. These aren’t just smash-and-grab operations or ransomware blitzes. The Huntress team spotted Chinese groups weaponizing open-source tools like Nezha and Gh0st RAT using a slick little maneuver called log poisoning. Picture them turning server logs into remote access backdoors—a trick so smart, it’s a “why didn’t I think of that?” moment. Targets are global, but yes, U.S. infrastructure and cloud providers are on the list. The briefing from Huntress shows the attackers using access to run PowerShell scripts, knock out Microsoft Defender protections, and lodge persistent malware for remote takeover. Spooky, right? Emergency bulletins today from CISA and the FBI are asking organizations—especially those handling legal, trade, or policy data—to fast-track patching on Oracle, VMware, and anything with open phpMyAdmin panels. CrowdStrike’s Charles Carmichael highlighted a critical Oracle zero-day, CVE-2025-61882, exploited with almost comedic speed by both Chinese and cybercrime actors this past summer. The message? Patch yesterday or hope you like ransomware. What about escalation? Here’s my speculative but seasoned scenario: if government shutdowns continue, a This content was created in partnership and with the help of Artificial Intelligence AI.