Microsoft has issued a security warning after discovering that multiple China‑linked hacking groups are exploiting a newly found flaw in SharePoint.
The platform is widely used in companies and government offices to store and share sensitive documents.
How the Attack Works
The flaw, identified as CVE‑2025‑53770, is a zero‑day vulnerability — meaning attackers began using it before a patch was available.
Through this flaw, hackers can steal security keys, install malware remotely, and potentially gain access to entire corporate networks running self‑hosted SharePoint.
Who Is Behind It
Microsoft revealed that at least three advanced groups are behind the attacks:
• Linen Typhoon – known for stealing intellectual property.
• Violet Typhoon – focused on espionage and data theft.
• Storm‑2603 – linked to earlier ransomware campaigns.
The company urged organizations running self‑hosted SharePoint servers to assume breach and begin full forensic investigations.
Security updates have now been released for all supported SharePoint versions, and Microsoft strongly advises users to apply them immediately.
Global Risk and Past Incidents
Cybersecurity experts warn that thousands of organizations — including government agencies, energy firms, and universities — could be at risk if they fail to patch their systems.
This incident follows similar accusations in 2021, when the group Hafnium was blamed for massive breaches on Microsoft Exchange servers affecting over 60,000 systems.
The Chinese government has repeatedly denied involvement in such cyberattacks.
