Microsoft seemingly confirms Chinese hackers behind SharePoint server attacks

A group of 7 hackers, 6 slightly blurred in the background and one in the foreground, all wearing black with hoods pulled up over their heads. You cannot see their faces. The hacker in the foreground sits with an open laptop in front of them. The background, behind the hackers, is a Chinese flag.

• Microsoft names three Chinese hacking groups it claims were abusing recently discovered flaws in SharePoint
• Hackers were apparently able to access sensitive data
• The company is confident the attacks will keep coming until the systems are patched

At least three major Chinese hacking groups were abusing recently discovered vulnerabilities to target businesses using Microsoft SharePoint, the company has said.

Microsoft recently released an urgent patch to fix two zero-day vulnerabilities affecting on-premises SharePoint servers, tracked as CVE-2025-49704 (a remote code execution bug), and CVE-2025-49706 (a spoofing vulnerability), which were being abused in the wild.

Now, Microsoft is saying that the groups targeting the flaws are Chinese state-sponsored groups - namely Linen Typhoon, Violet Typhoon, and Storm-2603.

Two typhoons and a storm

The first two are part of the larger “typhoon” operation, counting at least half a dozen organizations, including Brass Typhoon, Salt Typhoon, Volt Typhoon, and Silk Typhoon.

In the last couple of years, these groups were attributed with breaches into critical infrastructure organizations, government, defense, and military firms, telecom operators, and similar businesses, across the western world and NATO members.

Some researchers are saying that these groups were tasked with persisting in the target networks, in case the standoff between the US and China over Taiwan escalates into actual war. That way, they would be able to disrupt or destroy critical infrastructure, eavesdrop on important conversations, and thus gain the upper hand in the conflict.

At least seven major telecommunications operators in the United States have recently confirmed discovering Typhoon operatives on their networks and removing them from the virtual premises.

"Investigations into other actors also using these exploits are still ongoing," Microsoft said in a blog post, stressing that the attackers will definitely continue targeting unpatched systems.

SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 were said to be affected. SharePoint Online (Microsoft 365) was secure.

Microsoft recommends customers to use supported versions of on-premises SharePoint servers with the latest security updates immediately, and says users should ensure their antivirus and endpoint protection tools are up to date.

You might also like

• Microsoft releases urgent SharePoint security flaw patches - here's what you need to know, and how to update
• Take a look at our guide to the best authenticator app
• We've rounded up the best password managers