Volt Typhoon Goes Shopping for Cloud Tokens While Beijing Quietly Maps Your Water Supply

This is your Cyber Sentinel: Beijing Watch podcast. Hey listeners, Ting here with Cyber Sentinel: Beijing Watch, and this week China’s operators have been busy. Let’s start with the headline move: multiple threat intel shops, including analysts at Mandiant and Recorded Future, are tracking fresh activity from the group most folks call Volt Typhoon, a PRC state‑linked cluster that’s been burrowing into US critical infrastructure from ports to power grids. According to recent briefings out of Washington, these actors are doubling down on stealthy “living off the land” techniques, abusing built‑in Windows tools like PowerShell and WMI instead of flashy malware, which makes them blend into normal admin noise and evade a lot of legacy detections. The newest twist this week is their pivot into identity attacks. CrowdStrike and Microsoft analysts highlight a surge in token theft, MFA fatigue prompts, and careful targeting of privileged cloud accounts in US defense contractors and telecoms. The aim isn’t quick data theft; it’s persistent access that can be quietly re‑tasked during a Taiwan or South China Sea crisis. On the industrial side, Dragos and Nozomi Networks report Chinese‑linked reconnaissance against US water utilities and regional grid operators, focusing on engineering workstations and historian servers. It’s not Stuxnet‑style sabotage yet, but it is mapping the control plane so Beijing has options if geopolitics heat up. Attribution this week is stronger than usual. US and allied agencies are correlating infrastructure overlaps with known PRC front companies, reuse of bespoke command‑and‑control frameworks, Mandarin language artifacts in code comments, and tasking that lines up neatly with China’s Five‑Year Plan priorities in AI, chips, and green tech. The FBI and CISA keep pointing out that the same infrastructure supporting espionage against US universities is showing up in probes of semiconductor fabs in Arizona, Oregon, and Texas. Internationally, the response has sharpened. The US, UK, and Australia have rolled out coordinated advisories calling out Chinese state cyber actors by name and sanctioning several mainland and Hong Kong firms that allegedly provide cover for hacking operations. The European Union is more cautious but quietly tightening export controls on intrusion tools and high‑end accelerators that feed both AI and offensive cyber programs. Tactically, if you’re defending a US network, this week’s playbook is clear: harden identity, not just endpoints. Enforce phishing‑resistant MFA, lock down service accounts, monitor OAuth and SAML token usage, and baseline your admin tools so “normal” PowerShell is actually normal. Push better EDR coverage into OT adjacent Windows boxes, segment anything touching ICS, and rehearse incident response as if an operator plans to stay in your network for years, not days. Strategically, listeners, treat Beijing’s campaigns less like smash‑and‑grab hacks and more like long‑term prepositioning. This is about shaping the battlefield before conflict, influencing supply chains, and quietly collecting the data to power AI models that can optimize both economic and military decision‑making. I’m Ting, your friendly neighborhood China‑and‑cyber nerd. Thanks for tuning in, and don’t forget to subscribe. This has been a quiet please production, for more check out quiet please dot ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta