Microsoft Links Ongoing SharePoint Exploits to Three Chinese Hacker Groups

The digital battleground continues to evolve, and recent intelligence from Microsoft underscores the scale of the threats facing enterprise infrastructure. For organizations relying on Microsoft SharePoint Server, this revelation serves as a critical alert. Microsoft has officially correlated active exploitation of security vulnerabilities within internet-facing SharePoint Server instances to two distinct Chinese state-sponsored hacking groups, dubbed “Linen Typhoon” and “Violet Typhoon.” This confirmation, dating back to early July 2025, aligns with previous unconfirmed reports, painting a clearer picture of methodical and sustained campaigns.

Furthermore, Microsoft has identified a third China-based threat actor, tracked internally as “Storm-2603,” also leveraging these same SharePoint flaws. These groups are actively weaponizing these vulnerabilities to gain initial access to targeted networks, highlighting a coordinated and persistent effort to compromise critical business data and operations.

Understanding the Threat Actors: Linen Typhoon, Violet Typhoon, and Storm-2603

The identification of these specific groups provides crucial context for understanding the nature of the threats. While the exact motivations and targets may vary slightly, the shared modus operandi of exploiting SharePoint vulnerabilities suggests a common strategic objective: intelligence gathering, intellectual property theft, or potential preparatory actions for future disruptive operations. Organizations must recognize that these are not opportunistic attacks but rather calculated campaigns executed by sophisticated actors with significant resources.

• Linen Typhoon: Known for its advanced persistent threat (APT) capabilities, Linen Typhoon has a history of targeting government entities, defense contractors, and technology companies. Their exploitation of SharePoint vulnerabilities aligns with their typical objectives of long-term espionage and data exfiltration.
• Violet Typhoon: This group often focuses on supply chain attacks and gaining access to sensitive data within various industries. Their involvement in SharePoint exploits suggests an expansion of their initial access vectors, likely aimed at broader reconnaissance and lateral movement within compromised networks.
• Storm-2603: A newer identifier from Microsoft, Storm-2603 indicates another threat actor originating from China, leveraging the same SharePoint vulnerabilities for initial access. The emergence of a third distinct group, employing the same attack vectors, underscores the popularity and effectiveness of these specific flaws for malicious actors.

The Exploited Vulnerabilities: A Closer Look

While the exact CVE numbers for the SharePoint vulnerabilities exploited by these groups were not explicitly detailed in the original report, the ongoing nature of the attacks suggests that they are likely leveraging critical or high-severity flaws that allow for unauthenticated remote code execution (RCE) or privilege escalation within SharePoint Server environments. Such vulnerabilities are highly prized by attackers as they offer a direct path to system compromise.

For example, a common type of SharePoint vulnerability that could be exploited in this manner would be a deserialization flaw or an authentication bypass. When new information becomes available, it is crucial to cross-reference with official vulnerability databases such as the CVE Program for specific CVE IDs and detailed descriptions of the vulnerabilities.

Remediation Actions and Mitigations for SharePoint Server Instances

Given the confirmed exploitation by sophisticated threat actors, immediate and comprehensive action is imperative for any organization running internet-facing SharePoint Server instances. Proactive security measures can significantly reduce the attack surface and mitigate the risk of compromise.

• Immediate Patching: The most critical step is to ensure all SharePoint Server instances are fully patched with the latest security updates from Microsoft. Regularly review and apply security updates as soon as they become available. Establish a robust patch management policy.
• Network Segmentation: Isolate SharePoint Server instances on a dedicated network segment, restricting their communication only to necessary internal and external services. This can limit the impact of a breach and prevent lateral movement.
• Least Privilege Principle: Implement the principle of least privilege for all user accounts and service accounts interacting with SharePoint. Ensure that accounts only have the minimum necessary permissions to perform their functions.
• Multi-Factor Authentication (MFA): Enforce MFA for all administrative access to SharePoint Server, as well as for user access where feasible. MFA significantly reduces the risk of credential theft and unauthorized access.
• Intrusion Detection/Prevention Systems (IDPS): Deploy and configure IDPS solutions to monitor network traffic for suspicious activity, known attack signatures, and anomalous behavior targeting SharePoint servers.
• Web Application Firewall (WAF): Implement a WAF in front of internet-facing SharePoint Server instances. A WAF can detect and block common web-based attacks, including injection attempts and cross-site scripting (XSS), even before a patch is available.
• Regular Security Audits and Penetration Testing: Conduct frequent security audits and penetration tests on your SharePoint infrastructure. These assessments can identify misconfigurations, vulnerabilities, and potential attack paths before adversaries can exploit them.
• Log Monitoring and SIEM Integration: Centralize and monitor SharePoint Server logs (IIS logs, SharePoint ULS logs, Windows Event Logs) for unusual activity. Integrate these logs with a Security Information and Event Management (SIEM) system for real-time analysis and alerting.
• Endpoint Detection and Response (EDR): Deploy EDR solutions on SharePoint Server hosts to detect and respond to suspicious processes, file modifications, and network connections indicative of compromise.

Tools for Detection and Mitigation

Leveraging appropriate cybersecurity tools can significantly enhance an organization’s ability to defend against these sophisticated threats targeting SharePoint Server.

Tool Name	Purpose	Link
Microsoft Defender for Endpoint	Endpoint Detection and Response (EDR) for server protection.	Microsoft Defender for Endpoint
Microsoft Log Analytics / Azure Monitor	Centralized log collection and analysis for SIEM integration.	Azure Monitor
Tenable Nessus / Qualys VMDR	Vulnerability scanning and management for proactive identification.	Tenable Nessus
OWASP ZAP / Burp Suite	Web application security testing for WAF rule validation and vulnerability discovery.	OWASP ZAP
Any modern Web Application Firewall (e.g., Cloudflare WAF, Barracuda WAF)	Protects web applications from common attacks and vulnerability exploitation.	Cloudflare WAF (Example)

Key Takeaways and Future Outlook

The confirmed nexus between ongoing SharePoint Server exploits and three distinct Chinese hacker groups—Linen Typhoon, Violet Typhoon, and Storm-2603—underscores a persistent and evolving threat landscape. For IT professionals and security analysts, this situation demands immediate and sustained attention. Prioritizing patching, implementing defense-in-depth strategies, and continuously monitoring for indicators of compromise are no longer optional but essential. As adversaries continue to innovate, so too must our defenses, ensuring the integrity and security of critical enterprise infrastructure like SharePoint Server.