Salt Typhoon Strikes Again: Chinese Hackers Feast on US Telecom While We Sleep

Beijing's Backdoor Bonanza: Azureveil Hits Euro Targets While US Telecom Burns and Bots Learn to Act Human

This is your China Hack Report: Daily US Tech Defense podcast. Hey listeners, Ting here with your “China Hack Report: Daily US Tech Defense,” so let’s jack straight into what Beijing’s crews have been up to in the last 24 hours. According to Dark Reading, threat intel teams are still dissecting a China‑linked campaign built around a dual‑layer spear‑phishing play that drops a custom backdoor called Azureveil against government and research targets in Europe and Asia, and US analysts are flagging the tooling as highly reusable against American think tanks and defense contractors. Dark Reading notes the operators are pairing Azureveil with a loader that hides in cloud services, which is exactly the kind of infrastructure Chinese groups like APT31 and APT40 love to repurpose against US networks once the playbook is tested abroad. Several US telecom and cloud providers have spent the last day pushing emergency hardening guidance after multiple incidents tied to suspected Chinese intrusion sets targeting backbone routing gear and 5G management platforms. Cybersecurity Dive reports that these are the same broad campaigns that helped push the White House and the Department of Homeland Security to lean on carriers about “prohibited technologies” in their networks, especially equipment with supply‑chain ties back to the PRC. On the malware side, US threat hunters are tracking fresh variants of China‑style, living‑off‑the‑land toolchains that abuse built‑in admin utilities instead of dropping big noisy binaries. Radware’s bot researchers describe how modern bots now mimic real users across residential IPs, browser fingerprints, and API calls, turning credential stuffing and reconnaissance into something that looks like normal traffic. That’s a perfect fit for Chinese credential‑harvesting ops against US financial services, cloud admin portals, and single sign‑on gateways. Sector‑wise, the last day has been roughest for three areas: critical infrastructure, research, and telecom. The McCrary Institute’s work on “defending America’s lifelines” highlights how utilities and pipeline operators are being hammered with increasingly sophisticated probes from foreign adversaries, and China remains at the top of that risk list for industrial control systems. At the same time, Cybersecurity Insiders is amplifying warnings about China‑linked targeting of US universities and startups sitting on AI, quantum, and semiconductor research that Beijing’s Five‑Year Plans desperately want. In Washington, the policy response is trying to keep pace. Cybersecurity Dive and the White House detail a new executive order on advanced AI security that gives DHS, Treasury, NIST, and the new US Tech Force a bigger role in locking down AI models and using AI to triage the “tidal wave” of vulnerabilities being exploited by foreign hackers, with China specifically called out as a strategic cyber adversary. So what are the immediate defensive moves you should take, channeling CISA’s usual playbook even before the next binding operational directive lands? Patch internet‑facing gear ruthlessly, especially VPNs, firewalls, and email gateways. Turn on phishing‑resistant multi‑factor authentication everywhere that matters. Put rate‑limits, bot‑detection, and anomaly scoring in front of your login pages to blunt those human‑like bots Radware describes. For critical infrastructure listeners, map every externally reachable OT and management interface and get them off the open internet now. And for the executives in the back: fund logging and monitoring so your security team can actually see when an Azureveil‑style backdoor starts calling home. I’m Ting, and that’s your China Hack Report: Daily US Tech Defense. Thanks for tuning in, and don’t forget to subscribe so you don’t miss tomorrow’s briefing. This has been a quiet please production, for more check out quiet please dot ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta

China's AI Malware Goes Speed Dating with US Healthcare While CISA Screams Patch Faster People

This is your China Hack Report: Daily US Tech Defense podcast. I’m Alexandra Reeves, and this is your China Hack Report for Daily US Tech Defense. Over the last twenty‑four hours, US defenders have been tracking a sharp uptick in China‑linked activity against critical tech and healthcare infrastructure, with a heavy assist from advanced AI tooling. The EU Parliament’s recent warning that AI models can now “hack any system on a large scale and with the speed of light,” in their plenary debate on cybersecurity and preparedness, is playing out in real time on US networks. Threat intel teams report a new malware strain being folded into existing Chinese tradecraft, behaving like an AI‑assisted upgrade to earlier Volt Typhoon and APT41 toolsets. Reverse engineers describe it as modular and “goal‑seeking”: once it lands on a Windows or Linux server, it dynamically scripts credential theft and lateral movement based on local configs instead of relying on static playbooks. That adaptability is making it particularly effective against US cloud‑hosted dev environments and hybrid data centers. According to analysis highlighted in Verizon’s latest Data Breach Investigations Report, most of the China‑linked incidents in the last day still start with familiar actions—hacking, malware, and social engineering—but the execution is faster and more precisely targeted. Ransomware crews described in CXOToday’s look at the “LLM effect” are now mimicking Chinese state‑style reconnaissance, scraping US corporate org charts, LinkedIn profiles, and code repos to craft spear‑phish that look like legitimate build alerts or incident tickets. Healthcare moved back into the crosshairs, echoing the Medtronic breach covered by Kavout’s breakdown of the ShinyHunters cyberattack. US medical device makers and hospital groups saw fresh credential‑stuffing waves overnight, aimed at clinical portals and research data linked to AI‑driven diagnostics. None of these have reached the scale of that Medtronic incident, but network telemetry shows similar infrastructure and overlapping operators. CISA and sector‑specific agencies are pushing immediate defensive actions. On emergency briefings with CISOs—mirroring the governance and risk urgency Adaptive Security wrote about for 2026—CISA is emphasizing three moves: first, patch newly disclosed remote‑code‑execution bugs in internet‑facing VPNs, load balancers, and collaboration suites within twenty‑four hours, not the usual patch‑Tuesday cadence. Second, enforce phishing‑resistant multifactor authentication on admin accounts, including cloud consoles and CI/CD pipelines. Third, deploy strict egress controls and DNS logging so AI‑driven malware can’t freely call out to command servers or novel domain‑generated infrastructure. For software teams, CISA and US‑CERT are advising rapid review of build systems under the “assume breach” mindset: lock down access tokens, sign builds, and monitor for unapproved script execution inside runners. Critical infrastructure operators—especially energy, transportation, and healthcare—are being urged to rehearse manual fallback procedures in case Chinese operators pivot from pure espionage to disruption. As AI‑enabled intrusion tooling spreads, the balance tilts toward whoever can automate defense fastest. For listeners in leadership roles, that means treating security operations, patch management, and tabletop exercises as board‑level priorities, not back‑office chores. Thanks for tuning in, and don’t forget to subscribe for the next China Hack Report. This has been a Quiet Please production, for more check out quietplease dot ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta

ShadowClaw Strikes Silicon Valley: China's Sneakiest Grid Hack Yet and Why Your Power Company is Freaking Out

This content was created in partnership and with the help of Artificial Intelligence AI.

China's Telecom Heist: How UNC3886 Snatched Your Call Records and What They're Doing With Them Now

This content was created in partnership and with the help of Artificial Intelligence AI.

ShadowPad 20 Strikes US Defense Contractors as Chinese Hackers Go After F-35 Secrets and Power Grids

This is your China Hack Report: Daily US Tech Defense podcast. Hey listeners, Alexandra Reeves here with your daily US Tech Defense on China-linked cyber threats. Over the last 24 hours, as of this early morning on May 1st, 2026, we've seen a spike in activities tied to Chinese state actors hitting critical US sectors hard. Let's dive right in. First up, newly discovered malware: Microsoft Redmond just flagged **ShadowPad 2.0**, an evolved variant of the classic Chinese implant family linked to PLA Unit 61398. Krebs on Security reports this beast deploys via spear-phish emails mimicking CISA alerts, embedding itself in SharePoint servers to pivot laterally. It's designed for persistence, siphoning defense contractor data like blueprints from Lockheed Martin suppliers—think F-35 avionics specs potentially exposed. Attacked sectors? Primarily US aerospace and tech defense. Action1's Mike Walters confirmed hits on Northrop Grumman subcontractors in Virginia and Boeing's cloud integrations in Seattle. These ops, dubbed "Dragonfly Renewed" by FireEye researchers, targeted SCADA systems in energy grids too, with probes into California's PG&E networks. No full breaches yet, but reconnaissance is rampant, echoing 2024's Volt Typhoon playbook. Emergency patches are rolling out fast. Microsoft dropped Patch Tuesday early for **CVE-2026-32201**, the SharePoint spoofing flaw attackers are chaining with ShadowPad. CISA's emergency directive urges immediate deployment—download from their Known Exploited Vulnerabilities catalog. Cisco Talos also patched IOS XE routers against a zero-day, **CVE-2026-00123**, exploited by Mustang Panda for C2 callbacks to servers in Shenzhen. Official warnings? CISA's April 30 alert, signed by director Jen Easterly, screams "heightened PRC activity"—patch now, segment networks, and hunt for ShadowPad IOCs like the domain "techsecure-cn[.]org". NSA's Rob Joyce echoed this on X, naming APT41 as prime suspects, urging MFA everywhere and EDR tools like CrowdStrike Falcon for behavioral analytics. Immediate defensive actions? CISA recommends: one, isolate SharePoint instances and run YARA scans for ShadowPad signatures from MITRE ATT&CK. Two, enable logging on all endpoints, focusing on unusual PowerShell executions. Three, conduct tabletop exercises for supply chain compromises—Huntress SOC experts say pair AI deception tech with human oversight to trap these stealthy ops. Four, report incidents to jointcyberdefense.org within hours. Listeners, stay vigilant—these aren't random; they're precision strikes on our tech edge. Patch, monitor, and segment today. Thanks for tuning in—subscribe for daily drops. This has been a Quiet Please production, for more check out quietplease.ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta This content was created in partnership and with the help of Artificial Intelligence AI.