Dragon's Code: America Under Cyber Siege

About Dragon's Code: America Under Cyber Siege

This is your Dragon's Code: America Under Cyber Siege podcast. Dragon's Code: America Under Cyber Siege is your go-to podcast for detailed analysis of the week's most sophisticated Chinese cyber operations targeting US infrastructure. Stay updated with expert insights into attack methodologies, affected systems, and compelling attribution evidence. Discover the defensive measures implemented and lessons learned from each incident. Featuring interviews with leading cybersecurity experts and government officials, Dragon's Code delivers essential information for anyone interested in the evolving landscape of cyber warfare and national security. Tune in regularly for in-depth discussions that keep you informed and prepared. For more info go to https://www.quietplease.ai Check out these deals https://amzn.to/48MZPjs This content was created in partnership and with the help of Artificial Intelligence AI.

Publisher

Inception Point AI

Category

news · technology

Language

en

Explicit

No

First episode

13 Dec 2024

Latest episode

19 Jun 2026

Latest episodes

260 episodes in the feed.

1. 

   19 Jun 2026

   China's Secret Sleeper Cells in Your Power Grid: The Infrastructure Hack Nobody Saw Coming

   This is your Dragon's Code: America Under Cyber Siege podcast. Name’s Ting, your friendly neighborhood China-and-cyber nerd, and this week’s episode of Dragon’s Code: America Under Cyber Siege is…busy. Let’s jump straight to the hottest op: what analysts at Mandiant and CrowdStrike are calling a coordinated push by Chinese state-linked groups, including Volt Typhoon–style clusters, against US power and port infrastructure on both coasts. According to reports circulating among DHS and CISA briefings, the attackers focused on industrial control systems that manage power distribution, port cranes, and some regional water utilities, not to cause immediate blackout chaos, but to pre-position for future leverage. Methodology first, because I know my listeners. The crews are going “living off the land” all the way: abusing built‑in Windows tools like PowerShell and WMI, sneaking in via compromised VPN credentials, and then blending into normal network traffic. Several security teams say the intrusions rode in on old but still unpatched Fortinet and Ivanti gateways, plus stolen credentials bought from initial access brokers on Russian-language forums. Once inside, they pivoted laterally, mapped OT networks, and quietly dropped custom backdoors that talk out over HTTPS to cloud providers to look like normal business traffic. The affected systems? A West Coast power operator’s grid-monitoring network, at least two Gulf Coast ports’ logistics systems, and a Midwestern water utility’s remote pump controllers. None of these were allowed to flip physical switches, thanks to segmentation and some frantic cable‑pulling, but incident responders say the access was deep enough to be operationally serious. On attribution, the usual “China strongly denies” statement hit X within hours, but NSA and US Cyber Command officials briefed reporters that the malware toolchains, command‑and‑control infrastructure, and working hours all lined up with established PRC-linked outfits long tracked under names like Volt Typhoon and APT41. Microsoft and Google Cloud threat intel teams independently reported overlaps in infrastructure with earlier campaigns targeting Guam telecom and defense contractors, which hardened the case. Defensively, CISA pushed out emergency directives telling federal agencies and critical infrastructure operators to hunt for specific command patterns, disable outdated VPN appliances, and turn on strict multi-factor authentication everywhere. Several utilities spun up 24/7 threat-hunting cells, pulled their most sensitive OT networks fully offline from corporate IT, and deployed anomaly detection tuned to spot exactly this low‑and‑slow style of intrusion. The FBI’s Cyber Division also quietly knocked on doors of managed service providers that had been used as supply-chain stepping stones. Lessons learned? First, that “peacetime” is a myth in cyberspace; this is long‑term battlespace prep. Second, that identity is the new perimeter: stolen credentials are now more dangerous than zero‑days. Third, segmentation and rehearsed incident response saved the day; people who practiced tabletop exercises with CISA moved faster and lost less sleep. Cyber experts like Dmitri Alperovitch and former CISA director Chris Krebs are already arguing that these Chinese operations prove critical infrastructure needs security standards closer to nuclear-plant rigor than to office Wi‑Fi. I’m Ting, and if you’re still with me, you’re exactly the kind of listener I want in this cyber foxhole. Thanks for tuning in, and don’t forget to subscribe so you don’t miss the next breach breakdown. This has been a quiet please production, for more check out quiet please dot ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta

2. 

   17 Jun 2026

   Ting Spills the Tea: China's Hackers Are Literally Practicing How to Turn Off Your Lights

   This is your Dragon's Code: America Under Cyber Siege podcast. Name’s Ting. Let’s jack straight into Dragon’s Code: America Under Cyber Siege. Over the past few days, listeners, Chinese state-backed crews have been running some of the most sophisticated probing campaigns against US infrastructure we’ve seen this quarter. According to analysts at Mandiant and CrowdStrike, clusters linked to Volt Typhoon and APT41 have shifted from quiet reconnaissance to what one DHS official called “pre‑positioning for pressure,” especially against power grids and telecom backbones on the US East and Gulf Coasts. Method-wise, this wasn’t smash-and-grab ransomware. This was living-off-the-land. Operators slipped in through exposed VPN appliances and edge devices from vendors like Fortinet and Ivanti, then used built‑in tools like PowerShell, WMI, and scheduled tasks so their activity looked like a sleepy system admin on a night shift. Microsoft’s threat intel team has been warning that these China-nexus actors increasingly hijack legitimate credentials from contractors instead of dropping noisy malware, and that pattern held all week. What got touched? According to reports shared with CISA’s Joint Cyber Defense Collaborative, they hit operational technology at regional electric utilities, management interfaces for smart grid controllers, and network management systems in Tier‑1 ISPs. No lights-out moment, but in at least one unnamed utility in the Midwest, incident responders found test commands run against substation control systems—think rehearsal, not attack. Attribution is always the spicy part. This round tied back to familiar infrastructure: command-and-control servers previously mapped to Chinese operators, overlapping malware loaders seen in earlier Volt Typhoon operations, and time-of-day patterns matching work hours in Guangdong and Hainan. NSA’s Rob Joyce-style analysts pointed to reuse of custom tunneling tools and a preference for web shells on outdated IIS servers, signatures long associated with PRC-linked espionage units. Defensively, the US didn’t just watch. CISA pushed emergency directives for federal agencies to rotate credentials, segment OT from IT where it was still embarrassingly flat, and deploy enhanced logging to catch anomalous lateral movement. Several utilities invoked their playbooks under the NERC CIP standards, isolating affected substations and running manual override drills. Cloud providers like Amazon Web Services and Microsoft Azure quietly blocked suspect IP ranges and issued new detection rules to customers. Cybersecurity experts from places like the Atlantic Council and Stanford’s Internet Observatory are calling this week a wake-up that “steady-state intrusion” is now normal, not exceptional. The big lesson: attackers are betting on weak identity management and ancient edge gear more than zero-days. Multi-factor authentication, hardware security keys for admins, and ruthless patching of internet-facing devices did the most damage to these campaigns. And from government officials at the White House Office of the National Cyber Director, the message was blunt: treat Chinese cyber operations against infrastructure as strategic shaping, not random hacking. In other words, this is about leverage in a crisis. I’m Ting, thanks for tuning in, listeners. Don’t forget to subscribe so you don’t miss the next dive into Dragon’s Code. This has been a quiet please production, for more check out quiet please dot ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta

3. 

   15 Jun 2026

   Strip Mall Routers and Stolen Creds: How China's Hackers Turned Your Local Business Into a Weapon Against America's Grid

   This is your Dragon's Code: America Under Cyber Siege podcast. Name’s Ting, and Dragon’s Code is running hot, so let’s jack straight into this week’s Chinese cyber ops against America’s backbone. Over the past few days, US officials and private threat intel teams from places like Mandiant, CrowdStrike, and Recorded Future have been tracking coordinated intrusions into power grid control vendors, regional water utilities, and at least one West Coast port logistics operator. According to analysts at Mandiant, the tradecraft lines up with familiar Chinese state-linked groups like Volt Typhoon and APT41, who specialize in long‑term, low‑noise persistence inside critical infrastructure. Here’s how they did it. First wave: classic but polished spear‑phishing, using lures spoofing Department of Energy RFP documents and Port of Los Angeles vendor contracts. The payloads dropped living‑off‑the‑land toolchains, abusing PowerShell, WMI, and signed administrative binaries, so almost no traditional malware signatures fired. Parallel to that, CrowdStrike reports a supply‑chain style compromise of a minor but widely used remote monitoring tool for industrial controllers, giving the attackers pivot points into SCADA and OT networks without touching the front door. Once inside, they went quiet. Volt Typhoon‑style operators relied heavily on stolen credentials and VPN appliances, routing command‑and‑control traffic through compromised small business routers across the US and Europe. CISA officials say this made malicious traffic almost indistinguishable from normal admin activity. On the OT side, investigators found careful reconnaissance of IEC‑104 and Modbus devices, with read‑only access at first, suggesting pre‑positioning for future disruption rather than immediate sabotage. Attribution hinges on a mix of infrastructure overlap, malware code reuse, and tasking patterns. According to Microsoft’s threat intel team, several command servers reused TLS certificates previously tied to Chinese state operators, and the same custom exfiltration format seen in earlier campaigns against Guam telecoms popped up again here. NSA cyber director Rob Joyce has publicly noted that the timing and target set align with Beijing’s long‑term interest in gaining leverage over US critical infrastructure during a crisis in the Pacific. Defensively, it hasn’t been a quiet week. CISA, NSA, and FBI pushed out joint advisories, emergency directives to federal agencies to hunt for specific command‑line patterns, and new YARA rules for OT monitoring vendors. Utilities have been segmenting networks more aggressively, rolling out just‑in‑time admin credentials, and turning on deep packet inspection for those industrial protocols that used to be blindly trusted on internal links. Several ports temporarily shifted to manual fail‑safes while they validated their systems. Lessons learned? First, in 2026 the real cyber battlefield is the boring stuff: routers in strip malls, forgotten vendor accounts, and unmanaged OT gateways. Second, attribution is getting faster, which shrinks the window for quiet persistence but escalates diplomatic tension. And third, as Jen Easterly at CISA keeps reminding everyone, defense is now a team sport: if a small water authority in Indiana doesn’t patch its remote access box, it becomes Beijing’s free pivot into the national grid. I’m Ting, thanks for tuning in, and don’t forget to subscribe for more Dragon’s Code deep dives. This has been a quiet please production, for more check out quiet please dot ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta

Reach and audience

Public platform figures. Ratings count people who left a rating, not total listeners.

Apple Podcasts (US)

5.0 / 5

1 ratings

Podcast Authority Score: 47 / 100

A composite of feed quality, social presence, YouTube performance and engagement. Read the methodology.

Quality

93

Social presence

0

YouTube

0

Engagement

0