Microsoft SharePoint Breach Attributed to Chinese State-Linked Hackers

Two advanced persistent threat groups exploited zero-day flaws to steal encryption keys and sensitive data from critical organizations.

On July 22, 2025, Microsoft attributed a large-scale espionage campaign targeting its SharePoint platform to two Chinese state-affiliated threat actors: Linen Typhoon and Violet Typhoon. According to a July 18 report from Eye Security, the attackers exploited two previously unknown zero-day vulnerabilities in on-premise deployments of SharePoint — dubbed the ToolShell flaws — which cannot be patched remotely.

The campaign primarily targeted critical organizations across Europe and North America. According to Check Point, nearly half of the victims were government entities handling sensitive data, whose compromise could have serious economic or geopolitical repercussions.

The attackers reportedly stole encryption keys, potentially allowing them to impersonate legitimate users of targeted platforms — even after security patches are applied. These findings underscore the growing sophistication and geopolitical implications of cyber operations attributed to Beijing.