This is your Digital Frontline: Daily China Cyber Intel podcast.

Hey listeners, Ting here, and digital warriors, you’d better be caffeinated because the last 24 hours in the China cyber threatscape have been wilder than a Beijing nightclub at closing time. Today’s briefing cuts through the noise, spotlights new tactics, and arms you with the kind of juicy intel you won’t hear from your uncle who still thinks a firewall is something firefighters use.

Let’s start with the biggest headline: F5 Networks, the company whose BIG-IP devices practically prop up half the world’s data centers, just came clean that China-based UNC5221 snuck in and exfiltrated chunks of BIG-IP source code, along with secrets on undisclosed vulnerabilities and config info. The real drama? They camped out for over a year using a custom-built malware called BRICKSTORM. No, not the codename for my latest house party; it’s a persistence toolkit, and let me tell you, if you manage critical infrastructure, this is DEFCON 1. Lucky for us, CISA—America’s cyberwatchdogs—snapped out their new Emergency Directive faster than you can say zero-day exploit. Federal agencies and any org with government contracts should patch all F5 devices by—oh look at the clock—today, October 22nd, or risk meeting China in your server logs for breakfast. Disconnect any unsupported hardware and harden those exposed systems. It’s a wake-up call: if you’re sitting on out-of-date F5 gear today, UNC5221 just sent you a calendar invite—reply not optional.

Zooming out, let’s talk threat evolution. Trend Micro’s latest shows us the “Premier Pass” model. Not a fancy airport lounge, but a joint cyber campaign where groups like Earth Estries and Earth Naga hand off compromised networks like a relay race baton. These China-aligned APTs aren’t just after the usual suspects anymore—they’re mashing up targets from government and telecom agencies to retail. In just the past quarter, they’ve hit critical networks in NATO countries, APAC, and right here in the US, proving attribution isn’t just hard, it’s nearly quantum. Classic TTPs keep mutating: Earth Estries loves to pop vulnerable web servers, hand them off to Earth Naga, who then burrows deep for that sweet, sweet data. Pay attention, blue teams: assume lateral movement and accordion-style collaboration is now the norm.

And if you think telecom is the only bullseye, the Salt Typhoon campaign gives a reality check—this long-running PRC operation blew the doors off our biggest carriers, from Verizon to AT&T to T-Mobile. The impact? Potential blackmail on political figures, law enforcement intercepts at risk, and over a million call records snagged. Anne Neuberger from the White House called out their ability to geolocate millions—imagine the data-matching dance they can do with that. FBI and the Treasury have ramped up sanctions and disruption ops, but PRC’s botnets, like Volt Typhoon, keep popping back up. So much for patch and pray.

What should you do while policymakers debate hack-backs and sanctions? Easy wins first: update every public-facing device, patch F5 BIG-IP products immediately, and yank unsupported legacy hardware off the grid. Watch out for known indicators from BRICKSTORM, CrowDoor, and exploits like CVE-2025-5777. Educate your staff: phishing is still their favorite flavor. And folks, this is not the week to lag on network segmentation or compromise detection. Consider engaging with third-party security vendors—Mandiant, CrowdStrike, Trend Micro—who are already tracking these threats in near real time.

Remember, China’s cyber crews play the long game, but so do we. Thanks for tuning in to Digital Frontline: Daily China Cyber Intel. This is Ting signing off—don’t forget to subscribe for your daily dose of high-octane cyber truth. This has been a quiet please production, for more check out quiet please dot ai.

For more Back to Episodes