Wed, 23 Jul 2025

Wed, 23 Jul 2025 Microsoft servers hacked by Chinese groups, firm says

The US tech giant is recommending some users install security updates after the data breach.

* Chinese state-backed threat actors (Linen Typhoon, Violet Typhoon, and Storm-2603) have hacked Microsoft's SharePoint document software servers.
* The hackers targeted businesses using on-premises SharePoint servers, but not cloud-based services.
* Microsoft has released security updates to address the issue and advises all customers to install them.
* Investigations are ongoing into other actors using these exploits.
* The hackers used vulnerabilities in the software to steal key material and gain access to victims' SharePoint data.
* The "China-nexus actor" is deploying techniques similar to previous campaigns associated with Beijing.
* Linen Typhoon has been focused on stealing intellectual property for 13 years, primarily targeting organizations related to government, defense, and human rights.
* Violet Typhoon has been dedicated to espionage, primarily targeting former government and military staff, non-governmental organizations, and other high-profile groups.
  >>