The Silent Invasion: Inside China's Cyber War on US Defense Research

0:01 Welcome back everybody. Today, we're going to be looking at inside China's cyber war and US defense research. If you've been watching the world lately, you know the nature of warfare has completely shifted. It's not just about boots on the ground. It's not just about who has the biggest carrier strikes or the quiet submarines. The most dangerous battles being fought right now are helping are happening in silence.

0:24 They're happening on servers, data centers, and the networks of our most sensitive institutions. And most Americans have absolutely no idea we are actively losing a digital war. But Google's Threat intelligence group dropped the bombshell report. They're exposed a massive, multi year cyber espionage campaign orchestrated by a highly sophisticated threat actor known as UNC sixty five oh eight, a China and Nexus state sponsored hacker group, China cyber soldiers working directly for the People's Republic of China, and what they pulled off should scare the heck out of every single one of us. These folks didn't target random infrastructure.

1:02 They went off, They went after the crown jewels. They targeted North American medical, academic and military research institutions. The place is developing the next gen of American tech medical breakthroughs in US defense. I know you're asking, how did they get in? They found a weak point in an externally facing platform called REDCAP. For those who don't know, REDCAP stands for Research Electronic Data Capture. It's a secure web application used by scientists, military researchers, and doctors to build and manage online databases. It's exactly where you store highly classified, highly sensitive data when you're running advanced trials UNC sixty five. OHA found a way to crack those servers open, and once they got inside, they didn't just

1:42 smash and grab. That's not how these elite state actors operate. They play the long game. They deployed a highly customized piece of malware called infinitord. Think of infiniture as a digital ghost. It's a customer built, custom built tool designed for one specific purpose to sit quietly in the show shadows of a network, harvest credentials, steal user names and passwords passwords, and maintain what the tech world calls persistence.

2:08 They stayed hidden inside some of these environments for over a year. Think about that for a second. For twelve plus months, Chinese intelligence operators had a backdoor key to American military and medical research networks. They were sitting in the room virtually reading over the shoulders of our top scientists and defense strategists. So what are they looking for?

2:29 Everything that matters for the next fifty years of global dominance. They exfiltrated massive trops of data on advanced medical research. They stole US defense strategy documents. They targeted advanced technology, cutting edge artificial intelligence, and this is the part that really hits home. Autonomous and uncrude systems, drone technology, robotic warfare, the exact tech that our guys are going to rely on in the field to stay alive. If you want to defeat America in a conflict ten years from now, you don't want to wait for the war to start.

2:57 You steal the bootprints where they're still being written. If you want to defeat the soccer team in the World Cup before, you don't want to wait for them to start implementing their strategy. You want to know what it is beforehand if you can. But the technical but the technical sophistication didn't stop at the malware. The Google thread hunters discovered that these guys were using incredibly novel techniques to get the data out of our house and into theirs.

3:20 They actually manipulated Google workspace compliance rules. Think about how brilliant this is. They didn't use some loud, aggressive file transfer protocol that were triggered alarm. They quietly altered the internal administrative rules of the victim organization's own Google system. They made the system itself bypass its own security checks, treating the data theft like a routine, compliant, autumn heated task.

3:42 By the time security teams realized what was happening, that data was already gone. Fortunately, Google's Threat Intelligence group caught onto this. They acted. They disrupted the infrastructure of the UNC six y five oh eight was running, was using to run these operations, and that've been burning the men out OZO notifying the effected organizations to help them patch the holes and kick these ghosts out. But who is this?

4:05 But who else is there? Who else is in there right now that we haven't caught, That's the real question. This is not an isolated incident. This is a highly coordinated, incredibly well funded, asymmetrical war being waged against the US. When we're distracted by the news, nonsense, and the politics. Our adversaries are systematically draining our intellectual property and dismantling our tech edge. If we don't start taking cybersecurity as seriously as we take kinetic warfare, we're gonna wake up one day and realize we lost the war before a shot wasn't ever fired. Stay safe out there, everyone, and stay vigilant.