Archive — US — techcrunch
Google, Microsoft say Chinese hackers are exploiting SharePoint zero-day
Google and Microsoft report that China-backed hackers exploit a zero-day vulnerability (CVE-2025-53770) in Microsoft SharePoint, compromising sensitive data. Groups ‘Linen Typhoon’, ‘Violet Typhoon’, and ‘Storm-2603’ have been identified as perpetrators. Due to the exploitation, companies are urged to patch SharePoint servers as breaches have been ongoing since July 7, with many organizations already targeted.
Key points
- Hackers backed by China are exploiting a zero-day vulnerability in Microsoft SharePoint (CVE-2025-53770).
- The vulnerability allows attackers to steal sensitive keys and gain access to files and networks.
- Three China-linked groups: ‘Linen Typhoon’, ‘Violet Typhoon’, and ‘Storm-2603’ are exploiting this vulnerability.
- Microsoft observed hacks affecting SharePoint servers back to July 7, well before the vendor could issue patches.
- Organizations, particularly in government sectors, have reportedly been hacked due to this vulnerability.
- Patches have been rolled out by Microsoft for affected SharePoint versions, but risks remain for self-hosted systems.
Why it matters
- This incident reflects an ongoing trend of state-sponsored hacking, particularly from China, targeting software vulnerabilities.
- It is reminiscent of the 2021 Microsoft Exchange vulnerabilities exploited by hackers linked to China.
- The incident highlights the increasing need for organizations to enhance cybersecurity, particularly for widely used enterprise software.
The exploitation of the SharePoint zero-day vulnerability underscores the persistent risks of state-sponsored cyberattacks and highlights the critical need for robust cybersecurity measures in organizations worldwide.