Speaker 1: Welcome back everybody. Today, we're going to be looking at
inside China's cyber war and US defense research. If you've
been watching the world lately, you know the nature of
warfare has completely shifted. It's not just about boots on
the ground. It's not just about who has the biggest
carrier strikes or the quiet submarines. The most dangerous battles
being fought right now are helping are happening in silence.
They're happening on servers, data centers, and the networks of
our most sensitive institutions. And most Americans have absolutely no
idea we are actively losing a digital war. But Google's
Threat intelligence group dropped the bombshell report. They're exposed a massive,
multi year cyber espionage campaign orchestrated by a highly sophisticated
threat actor known as UNC sixty five oh eight, a
China and Nexus state sponsored hacker group, China cyber soldiers
working directly for the People's Republic of China, and what
they pulled off should scare the heck out of every
single one of us. These folks didn't target random infrastructure.
They went off, They went after the crown jewels. They
targeted North American medical, academic and military research institutions. The
place is developing the next gen of American tech medical
breakthroughs in US defense. I know you're asking, how did
they get in? They found a weak point in an
externally facing platform called REDCAP. For those who don't know,
REDCAP stands for Research Electronic Data Capture. It's a secure
web application used by scientists, military researchers, and doctors to
build and manage online databases. It's exactly where you store
highly classified, highly sensitive data when you're running advanced trials
UNC sixty five. OHA found a way to crack those
servers open, and once they got inside, they didn't just
smash and grab. That's not how these elite state actors operate.
They play the long game. They deployed a highly customized
piece of malware called infinitord. Think of infiniture as a
digital ghost. It's a customer built, custom built tool designed
for one specific purpose to sit quietly in the show
shadows of a network, harvest credentials, steal user names and
passwords passwords, and maintain what the tech world calls persistence.
They stayed hidden inside some of these environments for over
a year. Think about that for a second. For twelve
plus months, Chinese intelligence operators had a backdoor key to
American military and medical research networks. They were sitting in
the room virtually reading over the shoulders of our top
scientists and defense strategists. So what are they looking for?
Everything that matters for the next fifty years of global dominance.
They exfiltrated massive trops of data on advanced medical research.
They stole US defense strategy documents. They targeted advanced technology,
cutting edge artificial intelligence, and this is the part that
really hits home. Autonomous and uncrude systems, drone technology, robotic warfare,
the exact tech that our guys are going to rely
on in the field to stay alive. If you want
to defeat America in a conflict ten years from now,
you don't want to wait for the war to start.
You steal the bootprints where they're still being written. If
you want to defeat the soccer team in the World
Cup before, you don't want to wait for them to
start implementing their strategy. You want to know what it
is beforehand if you can. But the technical but the
technical sophistication didn't stop at the malware. The Google thread
hunters discovered that these guys were using incredibly novel techniques
to get the data out of our house and into theirs.
They actually manipulated Google workspace compliance rules. Think about how
brilliant this is. They didn't use some loud, aggressive file
transfer protocol that were triggered alarm. They quietly altered the
internal administrative rules of the victim organization's own Google system.
They made the system itself bypass its own security checks,
treating the data theft like a routine, compliant, autumn heated task.
By the time security teams realized what was happening, that
data was already gone. Fortunately, Google's Threat Intelligence group caught
onto this. They acted. They disrupted the infrastructure of the
UNC six y five oh eight was running, was using
to run these operations, and that've been burning the men
out OZO notifying the effected organizations to help them patch
the holes and kick these ghosts out. But who is this?
But who else is there? Who else is in there
right now that we haven't caught, That's the real question.
This is not an isolated incident. This is a highly coordinated,
incredibly well funded, asymmetrical war being waged against the US.
When we're distracted by the news, nonsense, and the politics.
Our adversaries are systematically draining our intellectual property and dismantling
our tech edge. If we don't start taking cybersecurity as
seriously as we take kinetic warfare, we're gonna wake up
one day and realize we lost the war before a
shot wasn't ever fired. Stay safe out there, everyone, and
stay vigilant.