This is your Cyber Sentinel: Beijing Watch podcast. I’m Alexandra Reeves, and this is Cyber Sentinel: Beijing Watch. Over the past few days, Chinese-linked operators have shifted gears from smash-and-grab theft toward long-term persistence inside critical U.S. networks. Analysts at Johns Hopkins’ Institute for America, China, and the Future of Global Affairs, speaking around the recent Trump–Xi summit in Beijing, stressed that cyber is now one of the main pressure valves in U.S.–China relations. While leaders talk de-escalation in Beijing, the keyboard war in the background is very much alive. Intelligence partners in Washington, London, and Canberra are flagging a noticeable uptick in living-off-the-land techniques from clusters overlapping with APT31 and Volt Typhoon. Instead of dropping obvious malware, they’re abusing built-in tools like PowerShell, WMI, and remote management services already present in Windows and common cloud platforms. The goal is to blend in with normal admin traffic so network defenders never notice the intrusion until it’s too late. Targeted industries this week skew heavily toward energy, telecom, and defense-adjacent manufacturing. In the U.S. power sector, investigators are tracking credential harvesting against vendors that maintain grid monitoring gear, the kind of access that doesn’t cause a blackout today but could map exactly how to cause one later. In telecom, Chinese operators are probing edge routers and 5G core components for configuration errors that can be chained into covert data taps on government and defense contractor traffic. On the attribution side, forensic teams are seeing familiar hallmarks: command-and-control servers repeatedly bouncing through Chinese hosting providers, tasking patterns that line up with known Ministry of State Security units, and code reuse from earlier campaigns that targeted dissidents and tech firms in Asia. Open-source investigations like those described by security researchers analyzing China’s “Sharp Eyes” surveillance infrastructure show how domestic surveillance tools and foreign cyber tradecraft often share the same vendors and software building blocks, reinforcing the state nexus behind these campaigns. International response is hardening. At the Trump–Xi meetings in Beijing reported by Johns Hopkins and Daily Sabah, cyber wasn’t front-page, but U.S. negotiators are said to have tied progress on trade and advanced chips to limits on state-backed hacking of commercial targets. Meanwhile, NATO members and Indo-Pacific partners are quietly syncing incident data in near real time, aiming to burn Chinese infrastructure faster so it has less reuse value. Tactically, defenders in U.S. organizations should assume compromise via normal-looking admin activity. That means aggressive monitoring of identity: phishing-resistant multifactor authentication; tight conditional access rules; and continuous logging of PowerShell, remote management, and domain controller changes. Network segmentation is critical, especially isolating operational technology in energy and manufacturing from corporate IT networks. Attack surface reduction rules in Microsoft environments, strict least-privilege for service accounts, and mandatory patching of edge devices like VPNs and firewalls close many of the doors these actors prefer. Strategically, the U.S. and allies need to treat Chinese cyber operations as a long-term shaping campaign, not a series of isolated hacks. The pattern this week is reconnaissance and prepositioning: map the grid, map the routers, map the contractors. That buys Beijing options in any future crisis over Taiwan or the South China Sea. Resilience planning—red-teaming whole sectors, rehearsing cyber disruption scenarios, and building rapid public–private intel sharing—matters as much as firewalls. I’m Alexandra Reeves. Thanks for tuning in, and don’t forget to subscribe so you don’t miss the next briefing. This has been a quiet please production, for more check out quiet please dot ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta
