Archive · 23 Jul 2025
China-Linked Hackers Exploit SharePoint Servers; Microsoft Responds
Some hackers with ties to China broke into SharePoint, software used by many companies and government agencies to share files.
They used a secret trick, called a zero-day exploit, to sneak in and steal important information like passwords.
Microsoft has fixed the problem with new security patches, but people using SharePoint still need to do extra things to be safe.
Microsoft has also decided not to use engineers based in China anymore to help the US military with its computer systems.
China-linked hackers exploited vulnerabilities in server software SharePoint.
The attacks targeted Internet-facing SharePoint servers in the US and other countries.
Hackers could steal sensitive data and harvest passwords using the zero-day exploit.
Microsoft deployed patches, but customers must also take additional security measures.
Microsoft will stop using China-based engineers for technical assistance to US defense clients.
- Who
- China-linked hackers (Linen Typhoon, Violet Typhoon, and Storm-2603) and Microsoft.
- What
- Exploitation of SharePoint vulnerabilities by China-linked hackers.
- When
- First signs of exploitation discovered on July 7; Patches deployed by Microsoft on Monday.
- Where
- US and other countries, targeting Internet-facing SharePoint servers.
- Why
- To steal sensitive data and harvest passwords.
Microsoft's Actions
China's Involvement
Security measures
Microsoft's Actions
Microsoft deployed patches to fix the vulnerability.
China's Involvement
Microsoft is taking steps to ensure that no China-based engineering teams are providing technical assistance for DoD Government cloud and related services.
- Software Targeted
- SharePoint
- Hackers Linked
- China-based
- Vulnerability Type
- Zero-day
- Affected Organizations
- Nearly 100
- Microsoft Action
- Deployed patches and restricted China-based engineers