This is your Dragon's Code: America Under Cyber Siege podcast. I am Alexandra Reeves, and welcome to Dragon's Code: America Under Cyber Siege. Picture this, listeners: it's been a brutal week for US infrastructure, with Chinese state-sponsored hackers—tracked as Volt Typhoon by Microsoft Threat Intelligence—launching their most sophisticated barrages yet, right up to this morning on April 26, 2026. It started Monday with intrusions into critical water treatment plants in Harris County, Texas, and a power grid substation in Spokane, Washington. These weren't brute-force DDoS floods; no, Volt Typhoon deployed stealthy living-off-the-land techniques, hijacking legitimate admin tools like PowerShell and Cobalt Strike beacons already embedded in networks for months. According to CISA's emergency directive issued Tuesday, attackers exploited unpatched Ivanti VPN gateways—CVE-2024-21887—to pivot laterally, mapping SCADA systems that control valves, pumps, and transformers. In Texas, they tampered with chemical dosing algorithms, nearly spiking fluoride levels to toxic thresholds before detection. By Wednesday, the siege escalated to port operations at Long Beach, California. Hackers infiltrated Navis N4 terminal software via supply-chain compromises in third-party logistics plugins from ZPMC cranes, sourced from Shanghai. FBI attribution pinned it on PRC Ministry of State Security affiliates, citing malware signatures matching Salt Typhoon campaigns and IP trails bouncing through compromised routers in Guangdong Province. Affected systems? ICS protocols like Modbus and DNP3, where custom implants exfiltrated operational blueprints—over 50 terabytes of grid schematics siphoned to servers in Shenzhen. Defensive measures kicked in hard Thursday: DHS activated Einstein 3.0 sensors across 200 federal networks, isolating segments with zero-trust micro-segmentation. CrowdStrike's Falcon platform, per their real-time blog, deployed AI-driven behavioral analytics that flagged anomalous PLC ladder logic changes, auto-quarantining 80% of infected endpoints. Energy Secretary Jennifer Granholm stated in a White House briefing, "We've surged 500 cyber hunters from NSA's Cyber Command to reinforce utilities, implementing mandatory EDR rollouts and air-gapped backups." Cybersecurity expert Dmitri Alperovitch of Silverado Policy Accelerator warned on a Friday CNN panel, "This is pre-positioning for hybrid warfare—imagine blackouts timed with Taiwan tensions." Lessons learned? Patching lags cost us; 70% of breaches stemmed from known vulns over 90 days old, as Mandiant's post-mortem report details. Shift to continuous validation, not quarterly scans, and harden OT with network telescopes. We've weathered the storm so far, listeners, but the dragons are still circling. Stay vigilant—patch now, segment everything. Thank you for tuning in, and please subscribe for more. This has been a Quiet Please production, for more check out quietplease.ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta This content was created in partnership and with the help of Artificial Intelligence AI This episode includes AI-generated content.