Google, Microsoft say Chinese hackers are exploiting SharePoint zero-day

Chinese state-backed hacking groups are actively exploiting a zero-day vulnerability (CVE-2025-53770) in self-hosted Microsoft SharePoint servers, allowing them to steal sensitive private keys, plant malware, and access data. Attacks by groups identified as "Linen Typhoon," "Violet Typhoon," and "Storm-2603" have been observed since July 7, compromising dozens of organizations, including government entities. This exploitation raises significant concerns for intellectual property theft, espionage, and potential ransomware, given the past activities of one linked group. While Microsoft has issued patches, organizations running affected SharePoint versions are advised to assume they have already been compromised, highlighting the persistent threat of state-sponsored cyberattacks on critical enterprise infrastructure.

Analysis

A critical zero-day vulnerability, CVE-2025-53770, in Microsoft's self-hosted SharePoint server software is being actively exploited by multiple hacking groups attributed to China. The exploit allows for the theft of private keys and remote access to sensitive internal data, with attacks observed since at least July 7. Microsoft has identified at least three state-backed groups—"Linen Typhoon" for intellectual property theft, "Violet Typhoon" for espionage, and "Storm-2603" with links to ransomware—as perpetrators, compromising dozens of organizations, including government entities. While Microsoft has released patches, its guidance for customers to assume they have already been compromised underscores the severity and indicates that remediation will be complex and costly for affected users. This incident mirrors the 2021 Microsoft Exchange server breaches, establishing a pattern of sophisticated, state-sponsored attacks on Microsoft's core enterprise infrastructure, which poses a significant and recurring reputational and operational challenge for the company. The strongly negative sentiment (-0.7 for MSFT) reflects the direct impact on its enterprise customers and the potential for financial repercussions.

Key Decisions for Investors

• Investors holding Microsoft (MSFT) should monitor for disclosures regarding the financial impact, potential customer migration from self-hosted to cloud solutions, and the persistent risk of its enterprise products being targets for state-sponsored cyberattacks.
• The widespread exploitation serves as a material tailwind for cybersecurity firms specializing in incident response, threat intelligence, and network security, presenting a potential catalyst for the sector.
• Portfolio managers should assess the exposure of their holdings to this vulnerability, as companies relying on self-hosted SharePoint may face significant business disruption and unforeseen remediation costs, particularly in IP-sensitive sectors.