Dragon's Code: America Under Cyber Siege

This is your Dragon's Code: America Under Cyber Siege podcast. Name’s Ting, your friendly neighborhood China-and-cyber nerd, and this week’s episode of Dragon’s Code: America Under Cyber Siege is…busy. Let’s jump straight to the hottest op: what analysts at Mandiant and CrowdStrike are calling a coordinated push by Chinese state-linked groups, including Volt Typhoon–style clusters, against US power and port infrastructure on both coasts. According to reports circulating among DHS and CISA briefings, the attackers focused on industrial control systems that manage power distribution, port cranes, and some regional water utilities, not to cause immediate blackout chaos, but to pre-position for future leverage. Methodology first, because I know my listeners. The crews are going “living off the land” all the way: abusing built‑in Windows tools like PowerShell and WMI, sneaking in via compromised VPN credentials, and then blending into normal network traffic. Several security teams say the intrusions rode in on old but still unpatched Fortinet and Ivanti gateways, plus stolen credentials bought from initial access brokers on Russian-language forums. Once inside, they pivoted laterally, mapped OT networks, and quietly dropped custom backdoors that talk out over HTTPS to cloud providers to look like normal business traffic. The affected systems? A West Coast power operator’s grid-monitoring network, at least two Gulf Coast ports’ logistics systems, and a Midwestern water utility’s remote pump controllers. None of these were allowed to flip physical switches, thanks to segmentation and some frantic cable‑pulling, but incident responders say the access was deep enough to be operationally serious. On attribution, the usual “China strongly denies” statement hit X within hours, but NSA and US Cyber Command officials briefed reporters that the malware toolchains, command‑and‑control infrastructure, and working hours all lined up with established PRC-linked outfits long tracked under names like Volt Typhoon and APT41. Microsoft and Google Cloud threat intel teams independently reported overlaps in infrastructure with earlier campaigns targeting Guam telecom and defense contractors, which hardened the case. Defensively, CISA pushed out emergency directives telling federal agencies and critical infrastructure operators to hunt for specific command patterns, disable outdated VPN appliances, and turn on strict multi-factor authentication everywhere. Several utilities spun up 24/7 threat-hunting cells, pulled their most sensitive OT networks fully offline from corporate IT, and deployed anomaly detection tuned to spot exactly this low‑and‑slow style of intrusion. The FBI’s Cyber Division also quietly knocked on doors of managed service providers that had been used as supply-chain stepping stones. Lessons learned? First, that “peacetime” is a myth in cyberspace; this is long‑term battlespace prep. Second, that identity is the new perimeter: stolen credentials are now more dangerous than zero‑days. Third, segmentation and rehearsed incident response saved the day; people who practiced tabletop exercises with CISA moved faster and lost less sleep. Cyber experts like Dmitri Alperovitch and former CISA director Chris Krebs are already arguing that these Chinese operations prove critical infrastructure needs security standards closer to nuclear-plant rigor than to office Wi‑Fi. I’m Ting, and if you’re still with me, you’re exactly the kind of listener I want in this cyber foxhole. Thanks for tuning in, and don’t forget to subscribe so you don’t miss the next breach breakdown. This has been a quiet please production, for more check out quiet please dot ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta

This is your Dragon's Code: America Under Cyber Siege podcast. Name’s Ting. Let’s jack straight into Dragon’s Code: America Under Cyber Siege. Over the past few days, listeners, Chinese state-backed crews have been running some of the most sophisticated probing campaigns against US infrastructure we’ve seen this quarter. According to analysts at Mandiant and CrowdStrike, clusters linked to Volt Typhoon and APT41 have shifted from quiet reconnaissance to what one DHS official called “pre‑positioning for pressure,” especially against power grids and telecom backbones on the US East and Gulf Coasts. Method-wise, this wasn’t smash-and-grab ransomware. This was living-off-the-land. Operators slipped in through exposed VPN appliances and edge devices from vendors like Fortinet and Ivanti, then used built‑in tools like PowerShell, WMI, and scheduled tasks so their activity looked like a sleepy system admin on a night shift. Microsoft’s threat intel team has been warning that these China-nexus actors increasingly hijack legitimate credentials from contractors instead of dropping noisy malware, and that pattern held all week. What got touched? According to reports shared with CISA’s Joint Cyber Defense Collaborative, they hit operational technology at regional electric utilities, management interfaces for smart grid controllers, and network management systems in Tier‑1 ISPs. No lights-out moment, but in at least one unnamed utility in the Midwest, incident responders found test commands run against substation control systems—think rehearsal, not attack. Attribution is always the spicy part. This round tied back to familiar infrastructure: command-and-control servers previously mapped to Chinese operators, overlapping malware loaders seen in earlier Volt Typhoon operations, and time-of-day patterns matching work hours in Guangdong and Hainan. NSA’s Rob Joyce-style analysts pointed to reuse of custom tunneling tools and a preference for web shells on outdated IIS servers, signatures long associated with PRC-linked espionage units. Defensively, the US didn’t just watch. CISA pushed emergency directives for federal agencies to rotate credentials, segment OT from IT where it was still embarrassingly flat, and deploy enhanced logging to catch anomalous lateral movement. Several utilities invoked their playbooks under the NERC CIP standards, isolating affected substations and running manual override drills. Cloud providers like Amazon Web Services and Microsoft Azure quietly blocked suspect IP ranges and issued new detection rules to customers. Cybersecurity experts from places like the Atlantic Council and Stanford’s Internet Observatory are calling this week a wake-up that “steady-state intrusion” is now normal, not exceptional. The big lesson: attackers are betting on weak identity management and ancient edge gear more than zero-days. Multi-factor authentication, hardware security keys for admins, and ruthless patching of internet-facing devices did the most damage to these campaigns. And from government officials at the White House Office of the National Cyber Director, the message was blunt: treat Chinese cyber operations against infrastructure as strategic shaping, not random hacking. In other words, this is about leverage in a crisis. I’m Ting, thanks for tuning in, listeners. Don’t forget to subscribe so you don’t miss the next dive into Dragon’s Code. This has been a quiet please production, for more check out quiet please dot ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta

This is your Dragon's Code: America Under Cyber Siege podcast. Name’s Ting, and Dragon’s Code is running hot, so let’s jack straight into this week’s Chinese cyber ops against America’s backbone. Over the past few days, US officials and private threat intel teams from places like Mandiant, CrowdStrike, and Recorded Future have been tracking coordinated intrusions into power grid control vendors, regional water utilities, and at least one West Coast port logistics operator. According to analysts at Mandiant, the tradecraft lines up with familiar Chinese state-linked groups like Volt Typhoon and APT41, who specialize in long‑term, low‑noise persistence inside critical infrastructure. Here’s how they did it. First wave: classic but polished spear‑phishing, using lures spoofing Department of Energy RFP documents and Port of Los Angeles vendor contracts. The payloads dropped living‑off‑the‑land toolchains, abusing PowerShell, WMI, and signed administrative binaries, so almost no traditional malware signatures fired. Parallel to that, CrowdStrike reports a supply‑chain style compromise of a minor but widely used remote monitoring tool for industrial controllers, giving the attackers pivot points into SCADA and OT networks without touching the front door. Once inside, they went quiet. Volt Typhoon‑style operators relied heavily on stolen credentials and VPN appliances, routing command‑and‑control traffic through compromised small business routers across the US and Europe. CISA officials say this made malicious traffic almost indistinguishable from normal admin activity. On the OT side, investigators found careful reconnaissance of IEC‑104 and Modbus devices, with read‑only access at first, suggesting pre‑positioning for future disruption rather than immediate sabotage. Attribution hinges on a mix of infrastructure overlap, malware code reuse, and tasking patterns. According to Microsoft’s threat intel team, several command servers reused TLS certificates previously tied to Chinese state operators, and the same custom exfiltration format seen in earlier campaigns against Guam telecoms popped up again here. NSA cyber director Rob Joyce has publicly noted that the timing and target set align with Beijing’s long‑term interest in gaining leverage over US critical infrastructure during a crisis in the Pacific. Defensively, it hasn’t been a quiet week. CISA, NSA, and FBI pushed out joint advisories, emergency directives to federal agencies to hunt for specific command‑line patterns, and new YARA rules for OT monitoring vendors. Utilities have been segmenting networks more aggressively, rolling out just‑in‑time admin credentials, and turning on deep packet inspection for those industrial protocols that used to be blindly trusted on internal links. Several ports temporarily shifted to manual fail‑safes while they validated their systems. Lessons learned? First, in 2026 the real cyber battlefield is the boring stuff: routers in strip malls, forgotten vendor accounts, and unmanaged OT gateways. Second, attribution is getting faster, which shrinks the window for quiet persistence but escalates diplomatic tension. And third, as Jen Easterly at CISA keeps reminding everyone, defense is now a team sport: if a small water authority in Indiana doesn’t patch its remote access box, it becomes Beijing’s free pivot into the national grid. I’m Ting, thanks for tuning in, and don’t forget to subscribe for more Dragon’s Code deep dives. This has been a quiet please production, for more check out quiet please dot ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta

This is your Dragon's Code: America Under Cyber Siege podcast. I’m Ting, and this week’s cyber story has one very clear villain: Beijing’s machine-like pressure campaign against American networks. According to Cybersecurity News, the most sophisticated Chinese operations hitting U.S. infrastructure were **Volt Typhoon** and **Salt Typhoon**, and together they show a strategy built less on smash-and-grab disruption and more on quiet access, prepositioning, and intelligence collection.[2] Volt Typhoon, as reported by Cybersecurity News, was inside U.S. critical infrastructure networks, moving in ways designed to avoid detection and preserve long-term access for possible future disruption during a geopolitical crisis.[2] That matters because the target set was not random internet-facing clutter; it was the nervous system of the country, the places where communications, energy, transportation, and emergency response all intersect. The methodology here was classic stealth tradecraft: living off the land, blending into normal administrative activity, and mapping systems without lighting up alarms like a bad holiday display.[2] Salt Typhoon went after U.S. telecom providers including **AT&T** and **Verizon**, with Cybersecurity News saying the campaign stole metadata and compromised communications tied to political figures including **Donald Trump** and **JD Vance**.[2] That is a different kind of pain. Instead of knocking a system offline, it gives an adversary a window into who talks to whom, when, and from where. In cyber, metadata is the gossip that tells the whole story. Attribution here is anchored by the nature of the campaigns themselves and by U.S. official concern reflected in the reporting. Cybersecurity News explicitly describes both operations as **Chinese state-sponsored** campaigns, and it frames them as part of a broader pattern of cyber-espionage used for geopolitical leverage.[2] The larger lesson from that reporting is that these are not lone-wolf intrusions but disciplined operations aligned with state objectives.[2] Defensively, the U.S. response has increasingly emphasized hardening, segmentation, and realistic training. TechCrunch reported that the FBI built a **22,000-square-foot replica town** in Huntsville, Alabama called the **Kinetic Cyber Range**, with houses, a hotel, a gas station, a grocery mart, a courthouse, a hospital, and a power company so investigators can rehearse real-world cyberattack scenarios in a believable environment.[8] That is not theater; that is muscle memory for a cyber age. It reflects the lesson that defenders need to practice not just alerts and dashboards, but recovery, coordination, and incident response in environments that mirror actual communities.[8] The big lesson this week is brutally simple: China’s top-end cyber play is about patience, access, and options. As Cybersecurity News describes it, these campaigns reveal both rising sophistication and deep vulnerabilities across sectors, while the FBI’s training push shows Washington knows the answer is not panic, but preparation.[2][8] Thanks for tuning in, listeners, and please subscribe. This has been a quiet please production, for more check out quiet please dot ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta

This is your Dragon's Code: America Under Cyber Siege podcast. I’m Ting, and this week’s cyber weather over the United States has been stormy, with China-linked operators making the headlines for one reason: access. U.S. officials and industry analysts say the most serious activity has centered on stealthy intrusion attempts against critical infrastructure, especially telecom, cloud, and industrial networks, using living-off-the-land tactics, compromised credentials, and disguised web infrastructure rather than flashy smash-and-grab attacks. [4][15] According to Cybersecurity Dive, researchers saw more than 10,000 World Cup-themed malicious domains pop up since January, while the FBI warned in May about spoofing attacks against FIFA websites; those same phishing and impersonation playbooks are the kind of tradecraft that also shows up in broader state-linked campaigns because they are cheap, scalable, and annoyingly effective. [4][2] Arctic Wolf said attackers used fake career sites to steal Google Workspace accounts and even weaponized an “employee handbook” PDF to target staff at a host city, which is a reminder that one bad click can turn into a full-blown foothold. [4] The more consequential China-linked set of activity this week is the kind Microsoft has tracked under names like **Storm-0940**, **Volt Typhoon**, and **Flax Typhoon**, where the goal is persistence, not publicity. These operations have relied on credential theft, proxy infrastructure, and exploitation of edge devices to blend into normal traffic and quietly stage access inside U.S. networks, including government, communications, and infrastructure targets. [15] Microsoft has repeatedly said these actors favor stealth over speed, because once they are inside, they can map systems, move laterally, and wait for a crisis moment. [15] Attribution is built from a pile of clues, not a single smoking gun: shared infrastructure, reused tooling, victimology, malware patterns, and long-running intelligence assessments from Microsoft and U.S. agencies. [15] The U.S. government has also treated China as the most persistent strategic cyber threat to American critical infrastructure, which is why defenders are watching for pre-positioning, not just data theft. [15] Defensively, the response has been very practical: hunt for unusual authentication patterns, lock down remote management interfaces, rotate credentials, patch internet-facing appliances fast, and segment industrial systems so a compromise in one zone does not become a tour of the whole plant. [15] Analysts at Arctic Wolf and Palo Alto Networks both stressed that phishing, QR-code fraud, fake portals, and ransomware against supporting services remain the most common entry points, even when the bigger strategic concern is state-backed disruption. [4] The lesson learned is brutally simple, listeners: the best Chinese cyber operations against U.S. infrastructure usually look boring at first. That is the trick. They are patient, credential-driven, and built to survive the noise, which means defenders need to think like hunters, not janitors. Thanks for tuning in, subscribe for more, and this has been a quiet please production, for more check out quiet please dot ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta

This is your Dragon's Code: America Under Cyber Siege podcast. I’m Ting, and this week’s cyber picture is a little too on-brand for “Dragon’s Code: America Under Cyber Siege.” The clearest China-linked pressure on U.S. infrastructure has centered on *operational technology* and the boring-but-critical systems that keep fuel moving, not flashy smash-and-grab hacks. According to the American Hospital Association, federal agencies warned on June 9 that malicious cyber activity has targeted U.S.-based automatic tank gauge systems, the remote monitoring gear that tracks fuel and liquid levels, temperature, and leak detection at storage tanks. That matters because these systems sit in the plumbing of airports, gas stations, hospitals, and logistics hubs, where a compromise can create real-world disruption fast. The warning followed a June 2 fact sheet from CISA and other agencies, which points to a campaign aimed at exposed tank gauge systems rather than ordinary office networks. The method here is classic infrastructure tradecraft: find internet-facing devices, probe for weak remote access, and exploit the thin security perimeter around industrial monitoring equipment. The lesson is painfully simple: if a sensor can be reached from the open internet, it can be turned into a foothold. [5] The attribution picture is less about a single smoking gun and more about the usual stack of evidence: targeting patterns, victimology, infrastructure focus, and the broader warning environment from U.S. officials. In recent public reporting, U.S. agencies have emphasized foreign cyber actors probing critical infrastructure, while private-sector trend data shows the threat environment staying hot. Check Point reported that government and telecommunications remained among the most attacked sectors in May 2026, with the United States accounting for 43% of all reported ransomware victims globally, which underscores why U.S. infrastructure keeps landing in the crosshairs. [2] Cybersecurity experts keep hammering the same defensive playbook, and for once the advice is not glamorous but it works. Segmentation between IT and operational technology, strict remote-access controls, device inventory, patching of exposed management interfaces, and alerting on unusual login or configuration changes are the basics. For tank gauge systems specifically, the agencies’ warning implies defenders should assume internet exposure is a liability, not a feature, and lock these devices behind VPNs, allowlists, and continuous monitoring. [5] The bigger lesson from this week is that sophisticated Chinese cyber operations do not always look like movie malware. Sometimes they look like patient reconnaissance against critical systems that most people never notice until they fail. That is the nasty brilliance of it, listeners: not breaking the flashy app, but bending the invisible infrastructure underneath it. Thanks for tuning in, subscribe, and keep your sensors off the open internet. This has been a quiet please production, for more check out quiet please dot ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta

This is your Dragon's Code: America Under Cyber Siege podcast. Listeners, I’m Ting, and Dragon’s Code is running hot this week, so let’s jack straight into it. Over the past few days, US officials say Chinese state-linked crews have been poking and prodding at the soft underbelly of American infrastructure: power grids, port logistics, and telecom backbones. According to the Cybersecurity and Infrastructure Security Agency, the most active suspect is the group analysts call Volt Typhoon, a stealthy espionage outfit that lives off the land, meaning it abuses built‑in Windows tools like PowerShell, WMI, and stolen admin accounts instead of flashy malware. That makes their traffic look like normal system admin work, which is why defenders hate them. Microsoft and several threat intel shops report that these operators have been tunneling through small routers and VPN appliances in places like California and Texas, turning vulnerable edge devices into a shadow proxy network. From there, they hop into utility control networks and port management systems, quietly mapping which systems control what: substations, cargo cranes, even rail signaling servers tied to major freight corridors. In one of this week’s more sophisticated waves, incident responders at a large US West Coast power company say they found carefully timed credential‑stuffing attacks against their remote access portals, followed by lateral movement that targeted engineering workstations connected to SCADA test environments. No lights went out, but the goal looked obvious: learn the layouts now so they can cause chaos later. Attribution is always messy, but FBI and National Security Agency analysts point to reused command‑and‑control infrastructure previously tied to Chinese strategic support forces, Mandarin-language comments in scripts, and tasking that lines up a little too neatly with People’s Liberation Army interest in “pre‑positioning” inside US critical infrastructure. On the defense side, CISA pushed out emergency directives urging utilities and port operators to rip out or at least segment old internet‑facing gear, crank up multi‑factor authentication, and enable detailed logging on domain controllers and VPNs. Several regional grids have spun up 24/7 threat‑hunting teams, feeding telemetry into joint fusion cells with the Department of Energy and the Federal Energy Regulatory Commission. Cybersecurity experts like Dmitri Alperovitch and Jen Easterly keep hammering the same lesson: this is not smash‑and‑grab ransomware, it is patient pre‑war reconnaissance. The playbook is persistence, not publicity. The big takeaway this week is brutal but clear: if an organization cannot see every admin login, every remote connection, it is already compromised and just hasn’t noticed yet. The silver lining? Each discovered foothold forces these operators to burn infrastructure and tools, shrinking their room to maneuver. Every patched router and monitored VPN narrows the dragon’s tunnel. Thanks for tuning in, and don’t forget to subscribe so you don’t miss the next chapter of Dragon’s Code: America Under Cyber Siege. This has been a quiet please production, for more check out quiet please dot ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta