エピソード

  • SentinelOne Hacked, Mobile Meltdown, & Salt Typhoons Spying Spree—China Cyber Tea, Freshly Brewed!

    SentinelOne Hacked, Mobile Meltdown, & Salt Typhoons Spying Spree—China Cyber Tea, Freshly Brewed!
    2025/06/28
    This is your Digital Dragon Watch: Weekly China Cyber Alert podcast.

    Welcome to Digital Dragon Watch: Weekly China Cyber Alert. I’m Ting—your expert in China cyber shenanigans, translating the week’s headlines into human-speak so you don’t have to read through a thousand threat intel feeds.

    Let’s dive right into the hotspots from the last seven days. At the top of the pile is the ongoing saga of SentinelOne, the U.S. cybersecurity firm that found itself in the crosshairs of a China-linked hacking collective. Over seventy organizations spanning manufacturing, finance, telecom, government, and research were caught in this months-long campaign, but it was SentinelOne’s hardware supplier that became the key target. The attackers, identified as part of the PurpleHaze group—closely associated with China’s infamous APT15 and UNC5174—used this vendor as a potential springboard for supply chain infiltration, even mapping internet-facing servers and evaluating them for follow-up attacks. SentinelOne’s researchers Aleksandar Milenkoski and Tom Hegel confirmed the attackers managed to breach all seventy targets, with some holding persistent access for extended periods. A staggering reminder: it’s not just your crown jewels—your supply chain is absolutely fair game too.

    Another red alert this week: Salt Typhoon, a state-sponsored crew also linked to China, exploited the Cisco CVE-2023-20198 flaw to worm into global telecom networks. Notable targets included Canadian telecom devices, with the attackers leveraging this vulnerability for deep reconnaissance. If you’re not patching your Cisco gear, you’re basically taping a “hack me” sign to your data center.

    Meanwhile, the mobile front is a growing minefield. Investigators from iVerify flagged a wave of mysterious crashes on smartphones—sometimes affecting journalists, government workers, and tech insiders. The sneaky part? These attacks seem to require no user interaction. Just having a vulnerable phone could open you up to infiltration, and guess what? Most victims worked in sectors of interest to Beijing. Rocky Cole at iVerify summed it up: “The world is in a mobile security crisis right now. No one is watching the phones.” Ominous, but true.

    U.S. government response? The State Department and CISA haven’t been silent. There’s been an uptick in official security advisories, especially for critical infrastructure and telecom sectors, urging immediate Cisco patching, increased insider vigilance, and air-gapping of particularly sensitive systems. Behind the scenes, partnerships with allied countries are intensifying, likely to ensure early warnings and rapid threat intelligence sharing.

    So, what’s on the expert cheat sheet this week? First, patch early, patch often—especially network gear and anything remotely related to supply chains. Second, don’t sleep on your mobile device protections; enterprise mobile device management should be standard, especially for execs and VIPs. Last, reevaluate who has access to what, both inside your walls and across vendors—zero trust isn’t a buzzword, it’s survival.

    That’s your China cyber wrap for this week. Stay patched, stay paranoid, and I’ll catch you on the next Digital Dragon Watch!

    For more http://www.quietplease.ai


    Get the best deals https://amzn.to/3ODvOta
    続きを読む 一部表示
    3 分
  • China's Cyber Typhoon Strikes Again! Telcos, Hospitals & Govs Beware - Ting Dishes the Deets

    China's Cyber Typhoon Strikes Again! Telcos, Hospitals & Govs Beware - Ting Dishes the Deets
    2025/06/26
    This is your Digital Dragon Watch: Weekly China Cyber Alert podcast.

    Welcome to another episode of Digital Dragon Watch: Weekly China Cyber Alert. I’m Ting, your friendly cyber-sleuth, here to cut through the digital smoke and mirrors and bring you the very latest on China-related cybersecurity from the past seven days.

    Let’s start with the headline-grabber: Salt Typhoon is back, folks, and this time the China-linked group zeroed in on a juicy Cisco vulnerability, catalogued as CVE-2023-20198. Over the weekend, we saw coordinated attempts to breach global telecommunications providers, with a special focus on Canada. This flaw, if you missed the memos, allowed attackers to escalate privilege and deploy malware on networking gear—prime real estate for a cyber espionage operation. Cisco responded by issuing urgent patches, and both US and Canadian agencies urged telcos to update firewalls and segment their networks pronto.

    Meanwhile, Taiwan remains the bullseye on China’s cyber dartboard, with attacks not just multiplying—they’re practically self-replicating. We’re talking 2.4 million daily cyber attempts, with about 80% targeting healthcare and government infrastructure. One jaw-dropping case involved MacKay Memorial Hospital: a 20-year-old hacker, Lo Chengyu, alias “Crazyhunter,” launched a ransomware blitz that crippled hundreds of systems and stole over 16 million patient records. The hospital stood firm, refusing the $100,000 ransom, and security teams eventually purged the malware without paying a dime. But Crazyhunter, not one to slink away quietly, published patient names online, ramping up pressure.

    These hospital attacks are all part of China’s grey-zone tactics. Not outright war, but digital harassment designed to wear down Taiwan’s resilience—targeting anything from hospitals to local government tax offices. Defensive measures? Taiwan’s own agencies have upped incident response drills and deployed advanced endpoint detection and response (EDR) systems, but officials admit the onslaught is straining resources.

    Across the Pacific, US government cybersecurity teams are still on high alert. After the December breach of a third-party US Treasury vendor by Chinese actors, this week’s guidance leans heavily on rapid patching, supply chain scrutiny, and stronger multi-factor authentication for government contractors.

    And if you thought enterprises were safe, think again. More than 70 organizations globally—including manufacturing, finance, research, and IT logistics—were hit in a PurpleHaze-linked wave of Chinese espionage from July 2024 to March 2025. SentinelOne’s cyber sleuths, Aleksandar Milenkoski and Tom Hegel, found reconnaissance and mapping of internet-facing servers, probably prepping for something bigger down the line.

    So, what are the pro tips from the experts this week? Patch, patch, patch—especially Cisco devices. Limit internet exposure of critical systems. Double down on EDR. And above all, rehearse incident response like you mean it, because the only thing scarier than a zero-day is being caught flat-footed.

    That’s your Digital Dragon Watch for the week. Stay patched, stay paranoid—Ting out.

    For more http://www.quietplease.ai


    Get the best deals https://amzn.to/3ODvOta
    続きを読む 一部表示
    3 分
  • Digital Dragons Gone Wild: SentinelOne Saga, Taiwan Targeted, and UK's China Woes!

    Digital Dragons Gone Wild: SentinelOne Saga, Taiwan Targeted, and UK's China Woes!
    2025/06/24
    This is your Digital Dragon Watch: Weekly China Cyber Alert podcast.

    Hello, cyber sleuths—Ting here with your Digital Dragon Watch, and trust me, this past week in China-linked cyber activity has been one for the books. Let’s jack in!

    First off, let’s talk about the headline-grabber: the SentinelOne saga. Between July 2024 and March 2025, more than 70 organizations got tangled in a sweeping set of attacks, with SentinelOne, a US cybersecurity firm, right in the crosshairs. The attackers? SentinelOne is putting the blame squarely on China, linking the activity to notorious clusters like PurpleHaze, APT15, and UNC5174. The victim list reads like a roll call for the global economy: government agencies, manufacturing giants, financial institutions, telecom players, research centers, and—get this—even the logistics company handling hardware for SentinelOne’s own team. These weren’t just drive-bys; some intrusions lasted for months, others got stomped out quickly, but all point to a sustained, high-stakes espionage campaign.

    What’s the big risk here? The hardware supply chain attack is especially chilling. The threat actors gained access to systems that could’ve been used to infect employee laptops before they even left the box, compromise OS images, or siphon off personal and location details. If you thought plugging in that brand new laptop was safe, well, time for a second opinion.

    While SentinelOne dodged a bullet, the threat vector rings alarm bells across the industry: third-party vendors have become a favorite playground for Chinese threat groups. The attackers focused on hardware logistics—knowing that if you own the supply chain, you own the company.

    Zooming out, this ties into a wider pattern. Chinese hackers have lately doubled down on reconnaissance—mapping internet-facing servers, sizing up vulnerabilities, and then pouncing. Just ask the government of Taiwan, where attacks have doubled and the targets are always high-value: government systems and telecom infrastructure. This dovetails with the UK’s own warnings earlier this month, naming China as the top national cybersecurity threat following a spate of breaches.

    US government response? Besides tightening its own third-party risk management, the Feds are beefing up requirements for vendors and pushing for zero-trust frameworks. The recommendations from experts are laser-focused: scrutinize your supply chain, segment your networks, keep an eye on internet-facing assets, and, above all, never underestimate reconnaissance. Today’s mapping is tomorrow’s breach.

    Final thought: As tensions keep simmering between China and its neighbors, cyber is the invisible front line. Stay patched, stay paranoid, and don’t let your guard down—because the digital dragons aren’t sleeping. Until next week, this is Ting, signing off but never logging out.

    For more http://www.quietplease.ai


    Get the best deals https://amzn.to/3ODvOta
    続きを読む 一部表示
    3 分
  • China Hacks Galore: SentinelOne Targeted, SAP Exploits Unleashed, and Taiwan Tensions Flare!

    China Hacks Galore: SentinelOne Targeted, SAP Exploits Unleashed, and Taiwan Tensions Flare!
    2025/06/21
    This is your Digital Dragon Watch: Weekly China Cyber Alert podcast.

    Hey everyone, Ting here with your rapid-fire rundown on the hottest China cyber action this week in Digital Dragon Watch: Weekly China Cyber Alert! No fluff—let’s dive deep into what’s been lighting up the cyber threat radar.

    First up, the biggest fireworks came courtesy of a sweeping campaign by China-backed actors, who, from July 2024 through this March, hit over 70 organizations across sectors from manufacturing to finance, government, and telecom. SentinelOne, the American cybersecurity powerhouse, found itself smack in the crosshairs. Attackers tried to surveil and breach one of SentinelOne’s servers, aiming to leverage their hardware supply chain. Imagine: compromised employee laptops, tainted OS images, or pilfered location data—all possible if they’d succeeded. SentinelOne’s detection and swift action kept the dragon at bay, but not before intrusions in some targeted orgs dragged on for extended periods. Researchers Aleksandar Milenkoski and Tom Hegel fingered China-linked clusters, primarily the notorious PurpleHaze—yes, that’s the same group overlapping with APT15 and UNC5174. The reconnaissance was surgical, mapping internet-facing servers, likely for future offensive moves.

    Speaking of critical infrastructure, researchers at EclecticIQ spotlighted Chinese APTs ramping up high-speed exploitation campaigns this April. The target? SAP NetWeaver Visual Composer, specifically hammering a fresh unauthenticated file upload flaw, CVE-2025-31324. That vulnerability opened the floodgates for remote code execution. If you run SAP landscapes—look alive! Evidence came straight from attacker-controlled directories, with logs showing mass exploitation and automated scanning using tools like Nuclei. This was no random spray-and-pray. UNC5221, UNC5174, and CL-STA-0048 were all linked by tradecraft and infrastructure signatures.

    Political tensions also drove cyber tempers high this week. China and Taiwan launched mutual accusations of cyber skullduggery, with both sides leaning hard into deniable espionage and disruption. That tit-for-tat is expected to churn all year, fueling the region’s digital arms race.

    With so much at stake, the US government isn’t standing idle. They’ve reinforced guidance for critical industries: patch SAP NetWeaver systems immediately, review supply chain security postures, and double down on endpoint monitoring. Experts shout from the rooftops—assume breach, hunt for post-exploitation traces, and don’t let vendor trust lull you into complacency.

    Final tips? Prioritize patching, segment your networks, and—seriously—monitor third-party suppliers. The game is adaptive and relentless. This week’s China activity proves it: the digital dragon is cunning, persistent, and always hungry. Stay alert and see you in the next Dragon Watch!

    For more http://www.quietplease.ai


    Get the best deals https://amzn.to/3ODvOta
    続きを読む 一部表示
    3 分
  • Digital Dragons Hack SentinelOne: Chinese Espionage Gone Wild!

    Digital Dragons Hack SentinelOne: Chinese Espionage Gone Wild!
    2025/06/19
    This is your Digital Dragon Watch: Weekly China Cyber Alert podcast.

    Welcome to Digital Dragon Watch: Weekly China Cyber Alert, I’m Ting—your favorite witty, slightly caffeinated, definitely cyber-obsessed companion. No time to waste, because China-linked adversaries certainly haven’t!

    Let’s cut straight to the breach: the single most significant incident this week comes from SentinelOne’s showdown with none other than China-nexus threat actors. These adversaries went for SentinelOne’s jugular, surveilling their servers and, more worryingly, hacking into an IT hardware supplier. The aim? Infect employee laptops before they even left the factory—hello, supply chain compromise! Fortunately, SentinelOne spotted the threat, slammed the cyber-door, and lived to tell the tale. But here’s the kicker: over 70 organizations got swept up in this campaign across sectors like manufacturing, finance, government, telecom, and research. SentinelOne researchers Aleksandar Milenkoski and Tom Hegel identified the perpetrators as a cluster called PurpleHaze, closely tied to APT15 and UNC5174. If those names don’t ring a bell, think China’s best in cyber espionage cosplay.

    The infiltration didn’t stop at SentinelOne. Victims included a South Asian government agency and a major European media house. The dwell time—the digital equivalent of how long burglars stayed in your house—varied from lightning-fast to several months. Scarier still, some intrusions were only remediated quickly thanks to SentinelOne’s sharp eyes. The attackers were thorough: mapping internet-facing servers and prepping for possible future attacks. Defenders, take notes—“just enough exposure for functionality” is a dangerous game.

    Meanwhile, the U.S. isn’t napping. In Congress, Senator Maria Cantwell has demanded answers from telecom titans AT&T and Verizon about the Salt Typhoon breach linked to Chinese state actors. These attacks were sophisticated enough to prod both companies into transparency, a minor miracle in telecom. And let’s not forget the UK. Their National Cyber Security Centre just publicly called out China as the dominant threat to national cybersecurity, after a string of hacks that had them pushing DEFCON levels.

    On the innovation front, attack vectors are getting creative. Just a few weeks ago, Chinese APT41 was caught using Google Calendar in its espionage toolkit. Why brute-force a firewall when you can slip a payload through your invite to “Weekly Sync”?

    What’s an expert to recommend? First, don’t trust your supply chain blindly—vet all third-party hardware. Network segmentation, tight access controls, and constant monitoring of both user and admin activity are a must. Run red team exercises to simulate these new attack vectors. For defenders out there, keep incident playbooks fresh—these threat clusters evolve faster than a TikTok trend.

    So, whether you’re a sysadmin watching patch cycles or a CEO wondering why the SOC budget is so high, the lesson is clear: China’s digital dragons are wide awake, but with vigilance, we can keep their fire at bay. This has been Ting, bringing you the byte-sized truth in a megabyte world. Catch you next week—unless I’m patching another zero day!

    For more http://www.quietplease.ai


    Get the best deals https://amzn.to/3ODvOta
    続きを読む 一部表示
    3 分
  • SentinelOne Snafu: China's Cyber Spree Snags Security Sweetheart!

    SentinelOne Snafu: China's Cyber Spree Snags Security Sweetheart!
    2025/06/17
    This is your Digital Dragon Watch: Weekly China Cyber Alert podcast.

    Welcome back to Digital Dragon Watch: Weekly China Cyber Alert. I’m Ting, your resident cyber-nerd with a soft spot for dumplings and zero tolerance for zero-days. Let’s power on to the biggest China-linked cybersecurity shake-ups of the week, and trust me, this one’s got everything: espionage, purple haze, and some seriously rattled supply chains.

    The headline grabber? SentinelOne—yes, the same cybersecurity company that’s supposed to be protecting everyone else—found itself smack dab in the crosshairs. Over the past nine months, more than 70 organizations across manufacturing, government, finance, telecom, and research were breached by China-nexus threat actors, with SentinelOne confirming it was hit through its own IT vendor. This was no drive-by: attackers hung out in some networks for weeks or months, mapping out targets and, in some cases, coming close to infecting employee laptops and collecting personal details before SentinelOne locked things down.

    If you’re wondering who’s behind the curtain, meet PurpleHaze and ShadowPad—two clusters with strong ties to China’s infamous APT15 and UNC5174 groups. These folks are pros. PurpleHaze was caught snooping around SentinelOne internet-facing servers last October, using reconnaissance and mapping tactics in preparation for follow-on attacks. There’s also evidence that the same actors poked at a South Asian government agency and what looks like a European media company, suggesting this is much bigger than just one North American target.

    Let’s zoom out: CrowdStrike’s latest threat report puts numbers to the madness. China-linked cyber activity surged 150% in the past year, with industrial, financial, and media sectors seeing attacks rise as much as 300%. Seven new Chinese APTs were spotlighted in 2024 alone. The real kicker? 75% of intrusions are now “malware-free,” relying on credential theft and hands-on-keyboard attacks that sidestep traditional security tools. Most cloud attacks come from abusing valid accounts, with cloud intrusions up 26% this year. Attackers are leveraging generative AI for hyper-realistic phishing and moving through networks at record speed—fastest breakout in just 51 seconds.

    How is Uncle Sam responding? US agencies are reinforcing supply chain checks and demanding stricter controls for third-party IT vendors—a lesson straight out of the SentinelOne playbook. Meanwhile, cybersecurity experts like Aleksandar Milenkoski and Tom Hegel at SentinelOne urge organizations to audit exposed infrastructure, monitor for unusual access, and double down on identity management. The golden rule: assume breach, verify everything.

    My advice? Get serious about credential hygiene, beef up cloud security, and treat vendor access like a loaded crossbow. And if you see someone named PurpleHaze sniffing around your network, it’s time to hit DEFCON 1.

    That’s a wrap for this week’s China cyber gauntlet. Stay paranoid, patch often, and I’ll see you next Tuesday on Digital Dragon Watch. Ting out.

    For more http://www.quietplease.ai


    Get the best deals https://amzn.to/3ODvOta
    続きを読む 一部表示
    3 分
  • Chin-vasion! SentinelOne Targeted, Supply Chain Hijinks, & Taiwan Under Siege in Epic Hack Attack

    Chin-vasion! SentinelOne Targeted, Supply Chain Hijinks, & Taiwan Under Siege in Epic Hack Attack
    2025/06/12
    This is your Digital Dragon Watch: Weekly China Cyber Alert podcast.

    Hey there, tech warriors! Ting here with your Digital Dragon Watch for June 12th, 2025. Let's dive right into this week's China cyber shenanigans, shall we?

    The biggest story breaking this week comes from SentinelOne, who just revealed they were targeted as part of a massive China-linked hacking campaign. Between July 2024 and March 2025, Chinese threat actors went after more than 70 organizations across multiple sectors including manufacturing, government, finance, and telecommunications.

    What makes this particularly sneaky is how the attackers operated. Rather than going straight for SentinelOne, they compromised a third-party IT services company that managed hardware logistics for SentinelOne employees. Talk about the digital equivalent of poisoning the well! According to SentinelOne's spokesperson, the attackers could have used this access to infect employee laptops before shipping or compromise OS images.

    SentinelOne researchers Aleksandar Milenkoski and Tom Hegel have attributed these attacks to threat clusters they're calling "PurpleHaze," which overlaps with known Chinese espionage groups APT15 and UNC5174. The good news? SentinelOne confirmed their investigation showed the attackers were unsuccessful in compromising their systems.

    This campaign isn't isolated. In October 2024, the same actors targeted a South Asian government agency and performed reconnaissance on SentinelOne's internet-facing servers. And remember, this comes just months after the UK's National Cyber Security Center named China as the dominant threat to national cybersecurity following a series of breaches in May.

    Let's also not forget what's happening in Taiwan, where Chinese cyberattacks doubled to a staggering 2.4 million daily attempts in 2024, according to Taiwan's National Security Bureau. These primarily targeted government systems and telecommunications firms, with successful attacks rising by 20% compared to 2023.

    For those of you wondering how to protect yourselves, here's my quick tech advice: scrutinize your supply chain relationships, implement zero-trust architecture, and monitor for the indicators of compromise related to PurpleHaze and ShadowPad malware that SentinelOne has published.

    The sheer scale of these operations shows China's cyber capabilities continue to evolve. As someone who's been watching this space for years, I'd say we're seeing a clear pattern of targeting the supply chain to get to high-value targets.

    That's all for this week's Digital Dragon Watch! Stay vigilant, update your systems, and remember: in cyberspace, the Great Wall isn't keeping threats in—it's projecting them out. This is Ting, signing off until next week!

    For more http://www.quietplease.ai


    Get the best deals https://amzn.to/3ODvOta
    続きを読む 一部表示
    3 分
  • Cyber Bombshell: China's Hardware Hijack Fail at SentinelOne—But 70 Others Weren't So Lucky!

    Cyber Bombshell: China's Hardware Hijack Fail at SentinelOne—But 70 Others Weren't So Lucky!
    2025/06/12
    This is your Digital Dragon Watch: Weekly China Cyber Alert podcast.

    Welcome to Digital Dragon Watch: Weekly China Cyber Alert—I’m Ting, your friendly cyber expert and resident digital detective. If you’ve spent the last seven days blissfully offline, buckle up, because the past week in China-related hacking has been a roller coaster of espionage, hardware hijinks, and cloak-and-dagger cyber squabbles.

    Let’s dive straight into the action: The most headline-grabbing event was a failed breach attempt against SentinelOne, one of America’s top cybersecurity firms. Chinese government-backed hackers, tied to the infamous PurpleHaze and ShadowPad groups—frequently associated with APT15 and UNC5174—tried to worm their way into SentinelOne’s defenses. Their approach was anything but basic. Rather than attacking the fortress head-on, they slipped in through a side door: targeting a hardware vendor responsible for shipping laptops and devices to SentinelOne employees. The idea? Compromise devices before they even reached their new desks. Imagine getting a “brand new” laptop for work, not knowing it’s already a ticking cyber time-bomb. Thankfully, SentinelOne detected the intrusion and slammed the door shut before any real damage could happen.

    But here’s the kicker: While SentinelOne dodged the bullet, these China-aligned threat actors successfully breached at least 70 organizations globally over the last several months. The sectors caught in their nets are a who’s who of modern industry—manufacturing, government, finance, telecommunications, and research. Victims included a South Asian government agency and a prominent European media outlet. This wasn’t a smash-and-grab operation, either; some intrusions lingered for “extended periods,” making cleanup a nightmare for incident responders.

    What about attack vectors? The recon bassline ran through internet-facing servers that were exposed by design—think servers necessary for remote work or customer access. The hackers methodically mapped these for vulnerabilities, planning for future attacks. Getting access to hardware supply chains is especially insidious because it gives attackers a backdoor before an organization even has a chance to install endpoint protections.

    On the U.S. government front, the response has been firm but familiar: increased information sharing with the private sector, new advisories on supply chain protection, and—my favorite—sternly worded warnings to critical infrastructure operators. Across the pond, the UK’s National Cyber Security Center also fingered China as the “dominant threat” in national cybersecurity, after rashes of breaches and persistent probing.

    So, what do the experts say? Their top recs: Don’t just watch for phishing emails—scrutinize your entire hardware supply chain. Regularly audit all internet-facing systems, use threat intelligence feeds to flag suspicious infrastructure overlaps, and ensure third-party vendors are following best practices.

    That’s your download for the week. As always, stay vigilant, patch your portals, and remember: in today’s world, your next “brand new” device could be a Trojan horse in a shiny plastic shell. This is Ting, signing off—until next week’s digital dragon hunt.

    For more http://www.quietplease.ai


    Get the best deals https://amzn.to/3ODvOta
    続きを読む 一部表示
    3 分