This is your Dragon's Code: America Under Cyber Siege podcast. I’m Ting, and this week’s cyber weather over the United States has been stormy, with China-linked operators making the headlines for one reason: access. U.S. officials and industry analysts say the most serious activity has centered on stealthy intrusion attempts against critical infrastructure, especially telecom, cloud, and industrial networks, using living-off-the-land tactics, compromised credentials, and disguised web infrastructure rather than flashy smash-and-grab attacks. [4][15] According to Cybersecurity Dive, researchers saw more than 10,000 World Cup-themed malicious domains pop up since January, while the FBI warned in May about spoofing attacks against FIFA websites; those same phishing and impersonation playbooks are the kind of tradecraft that also shows up in broader state-linked campaigns because they are cheap, scalable, and annoyingly effective. [4][2] Arctic Wolf said attackers used fake career sites to steal Google Workspace accounts and even weaponized an “employee handbook” PDF to target staff at a host city, which is a reminder that one bad click can turn into a full-blown foothold. [4] The more consequential China-linked set of activity this week is the kind Microsoft has tracked under names like **Storm-0940**, **Volt Typhoon**, and **Flax Typhoon**, where the goal is persistence, not publicity. These operations have relied on credential theft, proxy infrastructure, and exploitation of edge devices to blend into normal traffic and quietly stage access inside U.S. networks, including government, communications, and infrastructure targets. [15] Microsoft has repeatedly said these actors favor stealth over speed, because once they are inside, they can map systems, move laterally, and wait for a crisis moment. [15] Attribution is built from a pile of clues, not a single smoking gun: shared infrastructure, reused tooling, victimology, malware patterns, and long-running intelligence assessments from Microsoft and U.S. agencies. [15] The U.S. government has also treated China as the most persistent strategic cyber threat to American critical infrastructure, which is why defenders are watching for pre-positioning, not just data theft. [15] Defensively, the response has been very practical: hunt for unusual authentication patterns, lock down remote management interfaces, rotate credentials, patch internet-facing appliances fast, and segment industrial systems so a compromise in one zone does not become a tour of the whole plant. [15] Analysts at Arctic Wolf and Palo Alto Networks both stressed that phishing, QR-code fraud, fake portals, and ransomware against supporting services remain the most common entry points, even when the bigger strategic concern is state-backed disruption. [4] The lesson learned is brutally simple, listeners: the best Chinese cyber operations against U.S. infrastructure usually look boring at first. That is the trick. They are patient, credential-driven, and built to survive the noise, which means defenders need to think like hunters, not janitors. Thanks for tuning in, subscribe for more, and this has been a quiet please production, for more check out quiet please dot ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta