This is your Dragon's Code: America Under Cyber Siege podcast. Alright listeners, buckle up because what's happening in cyberspace right now is absolutely wild, and I'm Ting, your guide through the digital chaos. Chinese hackers just pulled off something pretty sophisticated this week. A group called UAT-8837, tracked by Cisco Talos researchers Asheer Malhotra, Vitor Ventura, and Brandon White, has been systematically breaching critical infrastructure across North America since at least 2025. These aren't script kiddies either. They're exploiting both zero-day vulnerabilities and compromised credentials to get their foot in the door of high-value organizations. Here's where it gets juicy. UAT-8837 recently exploited a SiteCore vulnerability called CVE-2025-53690 to plant themselves deep inside victim networks. Once they're in, they deploy this arsenal of tools that reads like a who's who of hacker playgrounds. They're using GoTokenTheft to steal access tokens, Earthworm to create reverse tunnels back to their servers, SharpHound to map Active Directory structures, and DWAgent for persistent remote access. The sophistication is in the layering. They cycle through different variants when one gets detected because most security products are already blocking the common ones. What makes this particularly concerning is their methodology after initial breach. They're running commands to extract security configurations using a tool called secedit, pulling Windows Local security policies, password policies, user rights assignments. In one intrusion, they actually exfiltrated DLL-based shared libraries from a victim's products, which suggests potential supply chain compromise attacks down the road. That's next-level thinking. The attribution confidence is medium, according to Talos, but the tactical overlaps with other China-linked operations are unmistakable. General Kevin Rudd, speaking before the Senate Armed Services Committee, highlighted that China's cyber forces are well-resourced, highly skilled, and directly integrated with Beijing's national objectives. Their clear intention is penetrating critical systems. Defense-wise, multiple countries are stepping up. Australia, Germany, the Netherlands, New Zealand, the UK, and the US just issued coordinated guidance on securing operational technology environments. They're emphasizing limiting exposure, centralizing network connections, using secure protocols, and hardening OT boundaries. Meanwhile, Congress is getting aggressive too. Chairman Andy Ogles stated plainly that the US needs to go on offense, not just defense, and that there will be a price to pay for infractions in cyberspace. The real lesson here is that we're not just playing defense anymore. This is active warfare, and it's happening in networks most people don't even realize are critical. UAT-8837 represents the new normal of state-backed persistence and tactical sophistication. Thanks for tuning in, listeners. Make sure you subscribe for more analysis. This has been a Quiet Please production, for more check out quietplease dot ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta This content was created in partnership and with the help of Artificial Intelligence AI
