Microsoft Links Ongoing SharePoint Exploits to Three Chinese Hacker Groups

Date: July 22, 2025
Category: Vulnerability / Threat Intelligence

Microsoft has officially connected the exploitation of vulnerabilities in internet-facing SharePoint Server instances to two Chinese hacker groups, Linen Typhoon and Violet Typhoon, as early as July 7, 2025, confirming earlier claims. Additionally, the company has identified a third threat actor from China, tracked as Storm-2603, also leveraging these vulnerabilities to gain initial access to target organizations. Microsoft stated in a report released today that, “Given the swift adoption of these exploits, we are highly confident that threat actors will continue to incorporate them into their attacks on unpatched on-premises SharePoint systems.” Below is a brief overview of the threat activity clusters:

  • Linen Typhoon (also known as APT27, Bronze Union, Emissary Panda, Iodine, Lucky Mouse, Red Phoenix, and UNC215), active since 2012 and previously linked to malware families including SysUpdate, HyperBro, and PlugX.
  • Violet Typhoon (aka …).

Microsoft Links Ongoing SharePoint Exploits to Three Chinese Hacking Groups

July 22, 2025

In a recent announcement, Microsoft has officially connected the exploitation of vulnerabilities in SharePoint Server instances to two Chinese cybercriminal organizations known as Linen Typhoon and Violet Typhoon. This confirmation reinforces prior reports regarding the ongoing attacks, which have been evident since July 7, 2025. Additionally, Microsoft has identified a third hacker group, tracked as Storm-2603, that is also leveraging these security flaws to gain unauthorized access to targeted organizations.

According to Microsoft, the increasing prevalence of these exploits highlights a significant concern for businesses utilizing unpatched on-premises SharePoint systems. The company expresses high confidence that these threat actors will continue to adapt these vulnerabilities into their modus operandi, escalating the risk for organizations worldwide.

Linen Typhoon, also known by aliases such as APT27, Bronze Union, and Emissary Panda, has been operational since 2012. This group has been associated with notable malware families including SysUpdate, HyperBro, and PlugX, showcasing a long-standing capability in executing sophisticated cyber operations. Meanwhile, Violet Typhoon, although less documented than its counterpart, remains actively engaged in similar exploitative activities, characterized by a reliance on specific techniques to infiltrate target networks.

These cyber threats primarily target businesses based in the United States, where reliance on SharePoint Server products may leave substantial exposure points if not adequately secured. The implications for organizations unable to apply timely patches are severe, potentially leading to data breaches and operational disruptions.

Utilizing the MITRE ATT&CK framework sheds light on the tactics and techniques employed by these adversaries. Initial access may be achieved through exploiting vulnerabilities in software, while persistence and privilege escalation tactics could be utilized to maintain access and elevate user rights within compromised systems. Such methods underline the sophisticated nature of these attacks, necessitating a proactive approach to vulnerability management among impacted organizations.

It is crucial for business owners to remain vigilant in their cybersecurity posture, safeguarding against these evolving threats. Regular updates and patches to software, coupled with informed awareness of potential vulnerabilities, can help mitigate risks posed by adversaries like Linen Typhoon, Violet Typhoon, and Storm-2603. As the landscape of cyber threats continues to shift, maintaining robust defenses has never been more paramount for organizations aiming to protect their digital assets.

Source link

Related Posts

Security Vulnerability: Hard-Coded Credentials in HPE Instant On Devices Enable Unauthorized Admin Access

Date: July 21, 2025
Category: Network Security / Vulnerability

Hewlett-Packard Enterprise (HPE) has issued critical security updates to rectify a significant vulnerability in Instant On Access Points. This flaw, identified as CVE-2025-37103, has a CVSS rating of 9.8 out of 10 and allows attackers to bypass authentication, potentially granting them administrative access to affected systems. According to the advisory, “Hard-coded login credentials were discovered in HPE Networking Instant On Access Points, enabling anyone aware of these credentials to circumvent standard device authentication.” Additionally, HPE has addressed another security issue involving authenticated command injection in the command-line interface (CVE-2025-37102, CVSS score: 7.2), which could allow remote attackers to execute arbitrary commands on the operating system with elevated privileges.

Microsoft Issues Critical Patch for SharePoint RCE Vulnerability Targeted in Ongoing Cyber Attacks

July 21, 2025
Server Security / Vulnerability

On Sunday, Microsoft released vital security updates to address an actively exploited vulnerability in SharePoint and provided details on another flaw that now has “more robust protections.” The company acknowledged it is “aware of active attacks targeting on-premises SharePoint Server customers by exploiting vulnerabilities partially addressed by the July Security Update.” The exploited vulnerability, tracked as CVE-2025-53770 (CVSS score: 9.8), involves remote code execution due to the deserialization of untrusted data in on-premises versions of Microsoft SharePoint Server. The newly identified issue is a spoofing vulnerability (CVE-2025-53771, CVSS score: 7.1), discovered and reported by Viettel Cyber Security and an anonymous researcher. The flaw is linked to inadequate restrictions on pathnames, leading to potential path traversal in Microsoft Office SharePoint…

⚡ Weekly Summary: Critical SharePoint Zero-Day, Chrome Vulnerability, macOS Spyware, NVIDIA Toolkit RCE, and More

Published: July 21, 2025
Category: Enterprise Security / Zero Day

Even the most secure environments are at risk as attackers bypass elaborate defenses—not with elaborate exploits, but by leveraging weak configurations, outdated encryption, and unprotected trusted tools. These stealthy attacks evade detection by blending into normal operations, exploiting gaps in monitoring and assumptions of safety. What once appeared suspicious now seems routine, thanks to modular techniques and automation that mimic legitimate behavior.

The critical issue? Our control is not only being tested; it’s being silently compromised. This week’s updates shed light on how default configurations, blurred trust boundaries, and exposed infrastructures are transforming standard systems into vulnerabilities.

⚡ Threat of the Week: Critical SharePoint Zero-Day Under Active Exploitation (Patch Issued Today)

Microsoft has rolled out patches for two security vulnerabilities in SharePoint Server that have been actively exploited, impacting numerous organizations globally. Details on the exploitation surfaced…

Hackers Exploiting SharePoint Zero-Day Since July 7 to Steal Keys and Ensure Ongoing Access

July 22, 2025
Vulnerability / Threat Intelligence

A recently revealed critical vulnerability in Microsoft SharePoint has been actively exploited since July 7, 2025, according to Check Point Research. The cybersecurity firm detected initial attacks targeting a major unnamed Western government, with activities escalating on July 18 and 19 across government, telecommunications, and software sectors in North America and Western Europe. Check Point identified the exploitation efforts originating from three separate IP addresses—104.238.159[.]149, 107.191.58[.]76, and 96.9.125[.]147—one of which was previously associated with the exploitation of vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) appliances (CVE-2025-4427 and CVE-2025-4428). “We are witnessing an urgent and active threat: a critical zero-day vulnerability in SharePoint on-premises is being exploited globally, endangering thousands of organizations,” stated Lotem Finkelstein, Director of Threat Intelligence at Check Point.