❓WHAT HAPPENED: Chinese hackers affiliated with the government exploited vulnerabilities in Microsoft SharePoint software, breaching multiple U.S. agencies, including the National Nuclear Security Administration (NNSA).
👤WHO WAS INVOLVED: Hackers linked to Chinese groups Linen Typhoon, Violet Typhoon, and Storm-2603; U.S. agencies, including the Department of Energy and others.
📍WHEN & WHERE: The breach began on July 18, 2025, impacting agencies in the U.S., Europe, and the Middle East.
💬KEY QUOTE: “The department was minimally impacted due to its widespread use of the Microsoft M365 cloud and very capable cybersecurity systems. A very small number of systems were impacted. All impacted systems are being restored.” – Department of Energy spokesman.
🎯IMPACT: The breach exploited cryptographic keys, enabling hackers to impersonate users or services. Microsoft has issued updates, but the full consequences remain unclear.
Chinese state-affiliated hackers have exploited a critical vulnerability in Microsoft SharePoint software to infiltrate several U.S. government agencies, including the National Nuclear Security Administration (NNSA), which is responsible for America’s nuclear weapons. According to multiple cybersecurity reports, the cyberattack began on July 18 and also affected organizations across Europe and the Middle East.
Microsoft has linked the attackers to groups it tracks as Linen Typhoon, Violet Typhoon, and Storm-2603. These groups reportedly took advantage of a zero-day flaw in SharePoint to gain unauthorized access, enabling them to steal cryptographic keys. This theft may have allowed them to impersonate legitimate users or services within affected systems. Microsoft has since issued security patches to mitigate the vulnerability and is urging all users to update their systems.
The U.S. Department of Energy confirmed that it experienced a disruption. A spokesman stated, “The department was minimally impacted due to its widespread use of the Microsoft M365 cloud and very capable cybersecurity systems. A very small number of systems were impacted. All impacted systems are being restored.”
Cybersecurity firm Eye Security revealed that the breach extended beyond the U.S., compromising around 400 entities worldwide. Among the impacted were the U.S. Education Department, the Florida Department of Revenue, and the Rhode Island General Assembly.
Security experts have described the threat as particularly severe. Carlos Perez, director of security intelligence at TrustedSec, emphasized the danger of the exploited vulnerability, calling it “critical” and warning that it was “already being actively exploited at scale.” According to Perez, the flaw allowed attackers to execute remote code on SharePoint servers, posing a serious threat to enterprise-level infrastructure.
Microsoft continues to stress the importance of immediate action. The company said the newly released updates are essential to prevent further exploitation and secure compromised systems.
Join Pulse+ to comment below, and receive exclusive e-mail analyses.
