Volt Typhoon's Grid Party: How China's Hackers Are Squatting in US Power Networks Like Bad Roommates

This is your Red Alert: China's Daily Cyber Moves podcast. Hey listeners, Ting here, your go-to gal for all things China cyber chaos—witty bytes with a side of zero-days. Buckle up, because the past few days have been a red-hot sprint of Beijing's hackers lighting up US targets like it's Double Dragon on steroids. We're talking Volt Typhoon, that stealthy Chinese APT crew UNC3886, burrowing deeper into American critical infrastructure as of this week. According to CYFIRMA's Weekly Intelligence Report from February 20, 2026, these pros—linked to China's state since 2021—have zeroed in on utilities, defense, telecoms, and tech, exploiting edge devices like VPNs and gateways with fresh zero-days. Dragos researchers warn they're still embedded in US power grids, mapping networks for the long game. Timeline kicks off mid-February: Palo Alto Networks spotted a massive hacking spree but held back naming China publicly—fear of Beijing's clapback, per Reuters sources on February 12. By February 19, Singapore's Cyber Security Agency mounted their biggest op ever against UNC3886, who hit four major telcos in a spying bonanza, stealing call metadata and more. Echoes hit the US defense industrial base hard—Google Mandiant reports Chinese crews compromising two dozen orgs for military secrets and IP theft, using living-off-the-land tricks to blend in. Fast-forward to yesterday, February 19: Philippine Armed Forces confirmed persistent China-based DDoS and malware barrages on their networks, amid South China Sea beef—mirroring patterns CYFIRMA tracks in US telecoms like AT&T and Verizon, where Salt Typhoon (another China alias) got evicted but left backdoors. No fresh CISA/FBI emergency alerts today, but CISA's KEV catalog just flagged BeyondTrust's CVE-2026-1731 exploitation in ransomware waves, with Chinese initial access brokers teeing up the plays. New patterns? Obfuscated malware hiding in Windows, token manipulation for priv-esc, and C2 over normal-looking traffic—straight from Volt Typhoon's MITRE playbook per CYFIRMA. Compromised systems include Norwegian telcos, Singapore providers, and US edge networks ripe for disruption. Defensive moves, stat: Patch Ivanti, BeyondTrust, SolarWinds pronto; hunt for anomalous C2 to external IPs; segment OT networks; enable MFA everywhere. US National Cyber Director Sean Cairncross just yelled this from Munich's Cyber Security Conference—deeper alliances or get played. Escalation scenarios? If Volt Typhoon flips from espionage to sabotage—like their grid footholds—they could black out East Coast power during a Taiwan flare-up, timed with Philippine-style sea tensions. Or pair with Iranian pals, using Chinese sats like MizarVision to spot US THAAD deployments at Jordan's Muwaffaq Salti Air Base, per Modern Diplomacy intel. Hybrid hell: DDoS distractions masking data exfil for hybrid warfare. Stay frosty, listeners—China's daily cyber tango ain't slowing. Thanks for tuning in; subscribe for more edge-of-your-seat This content was created in partnership and with the help of Artificial Intelligence AI.