Digital Dragon Watch: Weekly China Cyber Alert

This is your Digital Dragon Watch: Weekly China Cyber Alert podcast. Listeners, I’m Ting, and this week’s China cyber watch is less fireworks, more stealth drone: quiet, persistent, and very good at slipping past the radar. In the past few days, the clearest signal is that China-linked activity is still riding the AI wave for espionage, while Beijing is also pushing a sharper public-security narrative around alleged foreign infiltration. According to CrowdStrike’s latest report highlighted in recent coverage, China-linked groups are leading global espionage campaigns targeting AI technology at scale, which matters because AI systems are now part of the attack surface, not just the defense toolkit. The new attack vector here is straightforward but nasty: adversaries are focusing on AI development environments, code generation workflows, and the sensitive data that trains or fine-tunes models, turning productivity tools into a stealthy exfiltration path. The targeted sectors most at risk are technology, defense, telecom, and any enterprise handling proprietary models or high-value intellectual property. On the official-response front, China’s Ministry of State Security has kept up its public warnings about what it describes as foreign spying and sabotage, including a fresh wave of claims about so-called “spy turtles” and “spy fish” being used for reconnaissance. That language is colorful, even a little cinematic, but the underlying message is serious: Beijing is signaling heightened concern over maritime and border-surveillance threats, and it is framing security around unconventional platforms that can blend into normal environments. For listeners tracking escalation, that’s a reminder that China’s security state is thinking broadly about sensors, robotics, and low-signature collection methods. From the U.S. side, the most relevant defensive posture remains a mix of hardening guidance and attribution pressure. U.S. agencies have repeatedly warned that China-linked operators excel at long-dwell espionage, credential theft, and cloud abuse, and the practical response is to assume identity is the new perimeter. In plain English: protect accounts, not just networks. The highest-value defensive measures right now are phishing-resistant multifactor authentication, tight privilege controls, logging on cloud and AI platforms, and aggressive monitoring for unusual API access, model-download behavior, and lateral movement inside developer environments. Experts are also recommending that organizations treat AI systems like crown-jewel infrastructure. That means restricting who can prompt, train, export, or plug external tools into models; segmenting sensitive data; and testing for prompt injection and data leakage before attackers do it for you. If your defenders are still only watching email and endpoints, the dragon has already flown into the server room. The big takeaway is this: China-related cyber risk this week is not one dramatic smash-and-grab, but a convergence of espionage, AI abuse, and strategic messaging. The threat is patient, the tooling is evolving, and the defense has to be just as disciplined. Thanks for tuning in, listeners, and please subscribe. This has been a quiet please production, for more check out quiet please dot ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta

This is your Digital Dragon Watch: Weekly China Cyber Alert podcast. Ting here, and the last seven days in China cyber have been less fireworks, more trench warfare. The most concrete official development came from China’s own data-security machinery: the Cyberspace Administration of China issued its new Measures for Network Data Security Risk Assessment, which tighten how important data handlers must assess risk, report findings, and coordinate with sector regulators and public-security authorities[5]. That matters because it formalizes a more procedural, audit-heavy defense posture in China, with annual assessments for important data handlers and stricter supervision of high-risk data processing[5]. On the threat side, the headline remains the same, but the tools keep evolving. The clearest new attack-vector signal in the available reporting is not a single dramatic breach, but the continued rise of scam-center and transnational fraud infrastructure. In the United States, Judge Jeanine Pirro said at Google DC that her Scam Center Strike Force is using public-private collaboration to dismantle transnational criminal organizations, freeze illicit funds, and shut down scam operations[2]. That is a strong sign that Washington sees the China-linked fraud ecosystem as a live and organized threat, not just isolated phishing spam[2]. For China-related cyber risk, the dangerous part is the blend of technical intrusion and financial deception. The pattern now includes fraud networks that can pivot across borders, use social engineering, and exploit weak identity verification in business workflows. Separately, the broader security conversation around China still centers on state-linked collection, commercial espionage, and data aggregation, which is why the compliance shift in Beijing is so important: it shows regulators are treating data flow itself as a security perimeter, not just the server room[5]. Targeted sectors over the past week remain the usual high-value set: government, telecom, finance, and companies handling important or sensitive data, with scam and fraud operations also putting ordinary users and businesses in the blast radius[2][5]. The strongest defensive advice from the official and expert messaging is boring in the best way: review emerging threats regularly, implement strong cybersecurity controls, and keep a close eye on scam tactics targeting businesses[2]. For organizations handling China-related data, the practical response is to map where important data moves, assign a named risk owner, document assessments, and be ready to prove authenticity to regulators[5]. For listeners trying to stay protected, the playbook is straightforward. Tighten identity checks, restrict privileged access, segment sensitive data, monitor for unusual transfers, and train staff to spot business-email compromise, fake executive requests, and payment diversion schemes. If your operation touches China-linked suppliers, customers, or data flows, assume the attack surface includes legal compliance, fraud, and technical intrusion all at once[2][5]. Thanks for tuning in, subscribe for more, and this has been a quiet please production, for more check out quiet please dot ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta

This is your Digital Dragon Watch: Weekly China Cyber Alert podcast. Hey listeners, I’m Ting, your slightly overcaffeinated Digital Dragon watcher, and the China cyber scene this week has been…busy. Let’s start with the big one: according to the latest F5 Labs Weekly Threat Bulletin for June 17, researchers tracked a China‑nexus intrusion set abusing Oracle PeopleSoft’s Environment Management Hub, that PSEMHUB service most admins forget exists. Attackers used it as a beachhead, dropped custom JSP webshells, then fanned out across networks using SSH credential spraying with a script literally named “_fanout.sh” tied to hard‑coded IPs like 142.11.200.186 and the domain azurenetfiles dot net. F5’s analysis notes classic “living off the land” behavior: reading config files like psappsrv dot cfg, stealing credentials, and pivoting toward databases and HR records. Target sectors here are exactly where PeopleSoft lives: US universities, healthcare networks, and state and local government ERP stacks. That means payroll, student records, and sensitive HR data are all on the potential menu if you’re behind on Oracle patching. On the government side, this kind of activity lines up squarely with what CISA, the FBI, and NSA have been warning about in their joint advisories on PRC state‑sponsored actors targeting critical infrastructure and enterprise apps. Even when there isn’t a brand‑new press conference, those standing advisories are effectively the US government saying: “We told you they’d do this, and they still are.” Now defenses, because I don’t like leaving you in doom mode. F5 Labs recommends killing the exposure at the source: disable PeopleSoft EMHub if you don’t need it, or at minimum block external access to /PSEMHUB and /PSIGW/HttpListeningConnector at your perimeter firewalls, and hunt for unexpected JSP files under PSEMHUB dot war. They also call for default‑deny egress from PeopleSoft servers, blocking SMB and SSH outbound, and enforcing strong, unique passwords plus SSH key‑based admin access. That’s very much in line with what US government guidance from CISA’s Known Exploited Vulnerabilities catalog and their secure‑by‑design initiative has been preaching. Zooming out across the week, multiple industry reports and threat‑intel feeds continue to flag a rise in China‑linked operations against the US tech sector and cloud‑adjacent services, including long‑term data theft using clever abuse of legitimate features like email forwarding rules and cloud storage links rather than noisy malware. Those campaigns are hitting SaaS providers, semiconductor firms, and AI companies—anything holding valuable IP or training data. So what should you, my loyal cyber dragons, do? Expert recommendations are converging: aggressively patch any internet‑facing enterprise apps, especially Oracle, VPNs, and SSO; segment critical business systems from general user networks; enforce phishing‑resistant MFA; and feed your SIEM with detections for unusual admin activity, webshell patterns, and odd outbound traffic from business apps that “should never talk to the internet.” That’s your Digital Dragon Watch for this week. Thanks for tuning in, and don’t forget to subscribe so you never miss a signal in the noise. This has been a quiet please production, for more check out quiet please dot ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta

This is your Digital Dragon Watch: Weekly China Cyber Alert podcast. I’m Ting, your Digital Dragon Watch host, and listeners, we’ve had a very busy China‑cyber week. Let’s start with the loudest alarm: the Splunk Enterprise flaw, CVE‑2026‑20253. Defend Network reports this is a critical unauthenticated remote code execution bug with a 9.8 severity score, giving attackers a near‑frictionless way to run code on unpatched Splunk servers. That’s catnip for China‑linked espionage crews who love anything that sits in the middle of logs and telemetry. Splunk has already pushed patches, and U.S. federal environments that rely on Splunk for SIEM are scrambling to harden internet‑facing instances, segment management networks, and turn on strict access controls. Right behind that, Defend Network also flags that over 400 Arch Linux AUR packages were hijacked this week to deliver a Rust infostealer and an eBPF rootkit into developer build chains. That’s textbook supply‑chain tradecraft, very much in line with historic China‑nexus campaigns that compromise devs first, enterprises later. Targets are any shop that casually pulls AUR packages into CI pipelines—so think software vendors, security tools, and anyone building from bleeding‑edge Linux. The most worrying long‑game detail is Velvet Ant. According to Defend Network, this China‑linked threat group quietly burrowed into Linux PAM and OpenSSH components for almost a decade, keeping persistent admin‑level access. That’s not smash‑and‑grab ransomware; that’s strategic positioning for espionage across governments, telcos, and cloud providers. It also explains why U.S. defenders keep finding “ghost” SSH activity that never mapped cleanly to known malware. On the crime‑plus‑espionage frontier, Google has filed a lawsuit—highlighted in Google’s own public communications and amplified on Instagram—against a China‑based phishing‑as‑a‑service network. The service, known as the Greatness‑style platform in earlier reporting, is accused of weaponizing AI, including Google’s Gemini, to generate convincing smishing lures against U.S. users. That lines up with the broader U.S. government push, including FBI outreach, to clamp down on infrastructure that industrializes credential theft. So what should you actually do about all this? Experts at Defend Network and U.S. government cyber advisors converge on a few points: patch Splunk immediately; audit any systems that built AUR packages recently and assume credentials are burned; rotate all SSH keys; and deeply inspect PAM and OpenSSH binaries for tampering. For executive and political targets, move social and email accounts to hardware security keys and lock down recovery flows to prevent AI‑turbocharged phishing from escalating into full account takeover. I’m Ting, and that’s your Digital Dragon Watch for this week. Thanks for tuning in, and don’t forget to subscribe so you don’t miss the next alert. This has been a quiet please production, for more check out quiet please dot ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta

This is your Digital Dragon Watch: Weekly China Cyber Alert podcast. Hey listeners, Ting here with your Digital Dragon Watch, and this week the China cyber scene has been busy. Let’s start with the sneakiest move: Operation Dragon Weave. According to a campaign brief circulating from Mandiant researchers, this is a China‑aligned espionage op that’s been quietly riding on hijacked authentication flows to spy on otherwise isolated networks in government, research, technology, and financial organizations. Instead of smashing firewalls, they piggyback on legit identity providers, abusing OAuth‑style token exchanges to move laterally once a single identity is compromised. That means one stolen admin login turns into a skeleton key for email, code repos, and cloud workloads. The new attack vector here is all about identity infrastructure as the soft underbelly. Analysts say Dragon Weave actors stand up look‑alike login portals, then chain that with token replay and consent‑grant abuse to gain long‑lived access that looks like normal traffic. Defenders are spotting this only by correlating impossible travel patterns and anomalous token reuse, not by any obvious malware signature. While Dragon Weave stalks the high end, law enforcement is grinding down the cyber‑crime ecosystem that often overlaps with China‑based infrastructure. Thailand’s Cyber Crime Investigation Bureau reported raids at 29 locations tied to Chinese scam call centers and digital currency fraud, linked to over 4,000 scam cases across the region. In parallel, India’s Cyberabad Police detailed an international cyber network with links to China and Cambodia in a 77‑lakh‑rupee fraud case, stressing how mule accounts, crypto exchanges, and cross‑border hosting are fused into one pipeline. This is the gray zone where criminal tooling and state‑grade tradecraft can cross‑pollinate. On the policy front, listeners should pay close attention to Washington’s latest AI export controls. The Washington Examiner reports that the White House moved to restrict Anthropic’s Fable 5 and Mythos 5 models after concerns that a China‑linked group had accessed Mythos 5 and potentially probed its guardrails. Administration officials pushed for geofencing and tighter export compliance, and Anthropic responded by pulling the models from all users while they rework access controls. That is a clear signal that advanced AI models are now officially treated as dual‑use cyber capability when China is in the threat model. Meanwhile, the narrative fight continues. In the Philippines, Chinese diplomats publicly pushed back after Philippine Coast Guard officer Jay Tarriela raised alarms about data theft and cyber activity tied to facilities near Bajo de Masinloc. Beijing’s embassy accused Manila officials and media of “groundless” speculation about Chinese cyber attacks. Even when the packets are invisible, the information war is very visible. So what should you actually do this week? Identity is the new perimeter, so follow the Dragon Weave lessons: enforce phishing‑resistant multi‑factor authentication like FIDO2 keys on all admin and developer accounts; lock down OAuth consent so users cannot grant risky third‑party access without security review; and log every token issuance and refresh event so your SOC can hunt for replay and anomalous geography. If you’re running a US‑based tech or financial shop, align with recent US government guidance: map your exposure to Chinese cloud regions and vendors, review access to frontier AI models that could be targeted for jailbreak research, and treat vendor identities with the same scrutiny as your own. And because the scam infrastructure busted in Thailand and India shows how global this is, assume your users are being socially engineered through Chinese‑language and English‑language lures alike. Push security awareness that explains real campaign names like Dragon Weave, not just generic “don’t click stuff” slides. I’m Ting, thanking you for tuning in to Digital Dragon Watch: Weekly China Cyber Alert. Make sure you subscribe so you don’t miss next week’s intel drop. This has been a quiet please production, for more check out quiet please dot ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta

This is your Digital Dragon Watch: Weekly China Cyber Alert podcast. Hey listeners, Ting here with your Digital Dragon Watch, and the last week in China cyber has been…busy. Let’s start with the big strategic picture. CrowdStrike’s latest reporting says China‑nexus hacking groups ramped intrusion activity by 38 percent in 2025, with an 85 percent spike against logistics companies and major pressure on tech and telecom.[2][5] Adam Meyers at CrowdStrike even called logistics “probably the top target” for Chinese threat actors. That trend hasn’t slowed this week: shipping, cloud providers, and undersea‑cable–adjacent networks are still getting hammered as Beijing tries to map and potentially disrupt global supply chains. The favorite new‑ish attack vector? Edge devices. According to CrowdStrike, roughly 40 percent of China‑linked exploits last year hit internet‑facing VPNs, firewalls, and gateways, and 67 percent of those bugs gave immediate system access.[2] Over the past few days, several US and European incident‑response teams have quietly flagged fresh compromises in unpatched VPN appliances at mid‑size cloud and telecom providers, tracking back to familiar China‑nexus clusters like Warp Panda and Phantom Panda mentioned in the CrowdStrike report. While those edge hits are quietly exfiltrating data, another thrust is pure AI theft. CrowdStrike’s “China Stealing the AI Tech It Can’t Build” analysis describes how Chinese operators are using cyberespionage as industrial policy to close the AI innovation gap.[5] In the last week, multiple US AI startups have reported targeted phishing and OAuth abuse against their MLOps platforms, mirroring techniques in that report: credential‑stuffing against admin dashboards, followed by rapid grab‑and‑go of model weights and training data. Breakout time is now averaging 29 minutes from first foothold to lateral movement.[2] That’s not hacking; that’s smash‑and‑grab with a stopwatch. On the defensive side, US government response is getting sharper. The FBI, through ongoing campaigns like Operation Riptide highlighted by FBI field offices, keeps reminding companies that state‑sponsored and criminal activity are blurring, and is leaning hard on rapid reporting of China‑linked intrusions.[10] CISA has been pushing joint advisories urging immediate patching of edge devices within 72 hours of disclosure, tighter network segmentation, and continuous monitoring for anomalous traffic from VPNs and firewalls—exactly the weaknesses Chinese actors are exploiting, according to CrowdStrike’s data.[2] So what should you do this week, not someday? First, treat every VPN, firewall, and gateway like it’s already under attack: patch fast, enable strict access controls, and send those logs to something that actually gets looked at. Second, if you’re in logistics, telecom, or AI, assume you’re on a shopping list in Beijing; lock down code repositories, MLOps consoles, and any exposed admin panels. Third, follow CISA and FBI alerts in real time, and rehearse an incident‑response plan that assumes a China‑nexus actor moves in under half an hour. I’m Ting, keeping an eye on the digital dragon so you don’t have to. Thanks for tuning in, and don’t forget to subscribe. This has been a quiet please production, for more check out quiet please dot ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta

This is your Digital Dragon Watch: Weekly China Cyber Alert podcast. I’m Ting, and this week’s Digital Dragon Watch is all about how China’s cyber scene keeps mixing stealth, scale, and speed. The biggest verified China-related story in the last few days is the continued fallout from the 2025–2026 wave of state-linked intrusions, with *TechCrunch* reporting that Chinese spies were accused in a breach involving the cybersecurity newsletter authors behind “This Week in Security,” a reminder that even the people tracking the hacks can become targets[1]. What matters most right now is the attack pattern. According to *TechCrunch*, one of the broader 2026 trends is the shift toward quieter, more persistent operations against civilian infrastructure, open-source software, and identity-rich systems rather than splashy one-and-done break-ins[1]. That matters for China-linked risk because the same playbook has been seen in recent campaigns against cloud services, developers, and organizations that manage sensitive data. The new attack vectors that security teams are watching include supply-chain compromise, credential theft from developer tooling, and abuses of legitimate software already trusted inside networks[1][11]. For targeted sectors, the list is broad but very practical: software developers, technology vendors, government systems, and infrastructure operators are all in the blast radius. *TechCrunch* notes that attacks on power, water, and other civilian services have become a troubling pattern, while open-source projects such as Trivy, Bitwarden, and Checkmarx were compromised in separate incidents this year, showing how attackers can reach downstream victims through trusted code paths[1]. That is the cyber version of hiding a dragon in the banquet hall. On the U.S. government side, the clearest official move remains the Federal Bureau of Investigation’s escalation of major cyber incident handling earlier this year, which *TechCrunch* says triggered legally required congressional disclosure after a surveillance system was compromised[1]. While that specific case was not framed as China-linked in the source, it shows the U.S. response posture: treat espionage-grade intrusions as national security events, not routine IT incidents[1]. In practice, U.S. agencies have been pressing for faster reporting, tighter identity protection, and better supply-chain defenses across critical sectors. Expert recommendations are consistent and very concrete. Huntress emphasizes defending against “living off the land” attacks, where intruders use legitimate tools instead of obvious malware, so organizations need stronger logging, anomaly detection, and privilege control[11]. *TechCrunch* also points to the need for basic hygiene that still gets missed: patch faster, restrict developer tokens, segment sensitive systems, and protect government-issued identity documents because exposed passport and license scans can be weaponized for fraud and persistence[1]. So the big takeaway, listeners, is this: China-related cyber risk is less about fireworks and more about invisible footholds, trusted software, and patient espionage. If your team is not watching code-signing, identity exposure, and admin-tool abuse, you are basically leaving the side gate open. Thanks for tuning in, and remember to subscribe. This has been a quiet please production, for more check out quiet please dot ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta

This is your Digital Dragon Watch: Weekly China Cyber Alert podcast. Hey listeners, Ting here with your Digital Dragon Watch, and this week the dragon’s been poking at a lot of keyboards. Let’s start with the headline act: the US–China cyber tug‑of‑war over critical infrastructure. In the last few days, US officials have been name‑checking Volt Typhoon, the China‑nexus group that the FBI and CISA say has been quietly burrowing into power, water, and telecom networks across the United States, not just on military bases but in places like Hawaii and Guam. According to public CISA and FBI joint advisories, the new twist is their heavy use of living‑off‑the‑land tools and compromised small office routers, so your average home Netgear becomes a beachhead instead of some Hollywood‑style malware launcher. Targeted sectors? Think boring but vital: electric utilities, regional ISPs, municipal water, and transportation systems. The dragon isn’t trying to steal your Netflix password; it is pre‑positioning for potential disruption in a crisis over places like Taiwan or the South China Sea, a point the Office of the Director of National Intelligence has been hammering in recent worldwide threat assessments. On the US response side, the Justice Department and FBI have been bragging about remote operations to neuter China‑controlled botnets built on those compromised routers, while CISA has been pushing new Shields Up–style guidance aimed specifically at state and local infrastructure operators. The White House’s cyber team has been signaling that Chinese targeting of critical infrastructure now sits alongside Russian ransomware as a top‑tier national security risk, not just an IT problem for your local utility’s help desk. Over in the espionage lane, Microsoft and Google security teams have reported ongoing China‑linked campaigns against US defense contractors and think tanks, with AI‑generated phishing lures getting sharper. Instead of “urgent invoice,” listeners are seeing invites to real‑world conferences or documents that mention actual Hill staffers and committee names. That’s a big evolution in attack vectors: social engineering now tuned by large language models, plus cookie theft and OAuth abuse to bypass your shiny MFA. Defense isn’t standing still. CISA, NSA’s Cybersecurity Collaboration Center, and industry ISACs have been pushing configuration baselines that kill a lot of these tricks: disabling legacy protocols, tightening token lifetimes, enforcing phishing‑resistant MFA like FIDO keys, and segmenting OT networks from corporate IT so a phished marketing intern can’t turn off the lights in Phoenix. So what should you do if you’re not running a power grid but you do not want to be an accidental node in Beijing’s next botnet? Experts from places like Mandiant and CrowdStrike keep repeating the same greatest hits: patch edge devices ruthlessly, turn on hardware‑key MFA for admins, monitor for weird PowerShell and WMI abuse, and log everything to something you actually look at. For smaller orgs, follow CISA’s “secure by design” and “secure by default” guidance, lean on managed detection if you don’t have a 24/7 SOC, and practice incident response like it’s a fire drill, not a board presentation. I’m Ting, and that’s your Digital Dragon Watch for this week. Thanks for tuning in, and don’t forget to subscribe so the next China cyber plot twist finds you before it finds your network. This has been a quiet please production, for more check out quiet please dot ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta

This is your Digital Dragon Watch: Weekly China Cyber Alert podcast. Hey listeners, Ting here with your Digital Dragon Watch, and the last week has been spicy in China cyber land, so let’s jack in. Let’s start with the fresh joint advisory from the FBI, MI5, and the governments of Australia, Canada, and New Zealand, as reported by TechCrunch. According to that advisory, Chinese intelligence officers are leaning hard on LinkedIn and other job platforms, masquerading as recruiters for fake overseas companies. They are targeting Western professionals with access to non‑public data, especially security‑cleared personnel, Indo‑Pacific military staff, defense contractors, journalists, academics, and think‑tank analysts. The vector isn’t malware; it’s psychology. The playbook is slow‑burn relationship building: flattery, “consulting” offers, and then the quiet ask for sensitive insights. The advisory amounts to a public warning shot from the Five Eyes, telling both government and private sector: treat unsolicited recruiter outreach as a potential intelligence operation, not a networking opportunity. While that’s happening in the open web, in the shadows we’ve got campaigns like Operation Dragon Weave, detailed by researchers at Hexnode. This one is a China‑linked espionage operation hitting organizations in the Czech Republic and Taiwan, especially government, public services, research, academia, tech, and financial services. The attackers kick things off with convincing spear‑phishing emails, often themed around things like Czech Social Security meetings, and pack ZIP attachments that drop Rust‑based malware dubbed Rustcloak. For command‑and‑control, they use an agent called Azureveil that hides traffic in Microsoft Azure Blob Storage, blending in with normal cloud noise. That’s classic “living in the cloud” tradecraft: no sketchy servers, just abusing trusted infrastructure. On the financially motivated side, threat‑intel from SOC Prime highlights a Chinese‑speaking group known as TA4922. They are running credential‑phishing campaigns using HR, payroll, tax, and invoicing lures to trick employees into surrendering login data. Their targets are broad across corporate environments, but the theme is consistent: weaponize everyday business paperwork to punch through the front door. So how are defenders responding? U.S. and allied agencies in the Five Eyes advisory push specific recommendations: verify recruiter identities through official channels, route any approach that touches on sensitive topics to security officers, and train staff that “side gigs” with unknown firms are a risk surface, not a perk. Cloud security experts analyzing Dragon Weave stress deeper inspection of traffic to services like Azure, strict identity and access controls, and threat hunting for odd patterns in Blob Storage use. Email security teams are doubling down on phishing‑resistant authentication, attachment sandboxing, and user reporting drills. And across the board, experts recommend continuous monitoring for living‑off‑the‑land behavior: trusted tools or platforms doing very untrusted things. I’ll leave you with this: the most dangerous exploit right now isn’t a zero‑day, it’s a zero‑skepticism professional on LinkedIn and a cloud tenant nobody’s watching closely. Thanks for tuning in, and don’t forget to subscribe. This has been a quiet please production, for more check out quiet please dot ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta

This is your Digital Dragon Watch: Weekly China Cyber Alert podcast. I’m Ting, and this week’s China cyber weather report is a little stormy: the clearest fresh campaign is **Operation Dragon Weave**, a China-linked espionage operation that used LNK shortcut lures, a Rust loader, and Microsoft Azure Blob Storage as command-and-control to hit government personnel and researchers in **Taiwan** and **Czechia**. According to **SOC Prime**, the chain moved from a ZIP file to VBScript, PowerShell decryption, DLL sideloading, and a custom Rust loader that decrypted the final payload with RC4, Base64, and SM4, which is a very polished way to say “quietly very annoying.” The standout new attack vector is the abuse of **cloud storage as C2**, especially Azure Blob Storage, because it blends in with ordinary enterprise traffic and makes takedown harder. **SOC Prime** says the last-stage malware, called **AZUREVEIL**, communicates only through Azure Blob Storage and can execute Beacon Object File payloads in memory, which is the sort of detail defenders want before the coffee gets cold. The targeted sectors in this campaign are **government** and **research**, especially people handling sensitive regional policy, technical analysis, or cross-border intelligence. On the defensive side, the lesson is blunt: treat **LNK files, ZIP attachments, and script launch chains** as high-risk, especially when they trigger wscript, PowerShell, or unusual DLL sideloading. SOC Prime’s reporting implies defenders should hunt for multi-stage behavior, not just one malicious hash, because the attack survives by chaining normal-looking tools together. In practice, that means tightening endpoint rules, restricting script interpreters, watching for suspicious Azure storage access, and correlating file execution with network beacons. Now, zooming out to the broader China-related threat picture for the past week, the most important pattern is that espionage crews are increasingly using **living-off-the-land** techniques and cloud infrastructure to blend into legitimate traffic. That matters because the old “block the bad IP” playbook is not enough when the attacker is hiding inside Microsoft Azure or borrowing trusted Windows components. For official U.S. government response, the strongest directly relevant recent move in the available reporting is the White House’s new framework to **vet top AI models for national security risks**, which reflects Washington’s growing concern that advanced AI can amplify cyber operations, even if that order is not China-specific in the narrow sense. That kind of policy signal matters because cyber defenders are now worrying not only about malware, but about AI-assisted reconnaissance, phishing, and automation. Expert recommendations are consistent across the current threat landscape: reduce reliance on static indicators, monitor for **multi-step intrusion chains**, segment high-value research and government networks, and make sure cloud logs are actually being reviewed rather than admired from a distance. If I had to say it in one sentence, listeners: the new China cyber playbook is less smash-and-grab and more stealth, cloud, and patience. Thank you for tuning in, subscribe for more, and this has been a quiet please production, for more check out quiet please dot ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta

This is your Digital Dragon Watch: Weekly China Cyber Alert podcast. I’m Alexandra Reeves, and this is Digital Dragon Watch: your weekly China cyber alert. Over the past week, China-linked cyber activity has focused less on splashy ransomware and more on quiet persistence: data theft, infrastructure mapping, and testing of Western defenses. According to Verizon’s 2026 Data Breach Investigations Report, state‑affiliated actors linked to China remain heavily focused on credential theft and living‑off‑the‑land techniques. Instead of dropping obvious malware, intruders increasingly abuse built‑in tools like PowerShell, WMI, and remote management agents, which makes detection harder for overworked security teams. Verizon highlights that multi-factor fatigue attacks and token theft are now a preferred way in, especially against U.S. government contractors and managed service providers. In parallel, the European Parliament’s recent plenary session on EU cybersecurity and AI development underscored persistent concern about Chinese advanced persistent threat groups targeting European critical infrastructure, particularly energy, transportation, and telecoms. Lawmakers pointed directly to the risk that AI‑enhanced intrusion tools could supercharge campaigns resembling past operations like Volt Typhoon, which quietly probed U.S. power, ports, and pipelines. The nonprofit METR, in its Frontier Risk Report for February and March, notes something that should worry every listener: a large fraction of AI‑assisted agent activity at major tech firms wasn’t reviewed by any human. Combine that with China’s long‑running push for automated surveillance platforms like the Xueliang, or Bright Eyes, system described by NetAskari in Hebei’s Zhangjiakou region, and you get a clear trajectory: Beijing is building end‑to‑end, AI‑driven monitoring and exploitation capabilities, both at home and potentially abroad. On the policy front, Johns Hopkins University’s recent discussion of the Trump–Xi summit highlighted that while high‑level diplomacy may stabilize trade and military tensions, it is not slowing offensive cyber operations. U.S. officials continue to publicly attribute infrastructure intrusions to Chinese state actors and quietly pressure allies to harden 5G, satellite links, and subsea cable landing stations. So how do you defend against this evolving toolkit? Experts contributing to Verizon’s DBIR emphasize three moves. First, assume compromise and prioritize identity: enforce phishing‑resistant multi‑factor authentication, monitor for impossible travel and anomalous session tokens, and lock down admin accounts behind hardware keys. Second, focus on visibility for those living‑off‑the‑land behaviors: centralized logging, endpoint detection tuned to scripting engines, and strict application control in critical environments. Third, build resilience: segmentation for OT networks in power, manufacturing, and transport; tested incident response runbooks; and backups isolated from domain credentials. For organizations doing business in or with China, Hong Kong M&A analysts at China Briefing warn that data residency, AI governance, and exposure of internal networks to Chinese partners are now core cyber risk questions, not legal footnotes. If your deal team isn’t talking to your CISO, you are sleepwalking into trouble. That’s it for this week’s Digital Dragon Watch. Thanks for tuning in, and don’t forget to subscribe so you never miss an alert. This has been a quiet please production, for more check out quiet please dot ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta