Slashdot: US Nuclear Weapons Agency ‘Among 400 Organizations Breached By Chinese Hackers’

Jul 23, 2025

—

Source URL: https://news.slashdot.org/story/25/07/23/1652240/us-nuclear-weapons-agency-among-400-organizations-breached-by-chinese-hackers?utm_source=rss1.0mainlinkanon&utm_medium=feed
Source: Slashdot
Title: US Nuclear Weapons Agency ‘Among 400 Organizations Breached By Chinese Hackers’

Feedly Summary:

AI Summary and Description: Yes

Summary: A cyber-espionage campaign targeting unpatched Microsoft SharePoint vulnerabilities has compromised around 400 organizations globally, including significant US government agencies. This underscores the critical need for robust patch management and security measures to mitigate risks from identified vulnerabilities.

Detailed Description: The ongoing cyber-espionage campaign highlights serious vulnerabilities in Microsoft SharePoint systems that remain unpatched. The scale of the breach, involving approximately 400 organizations, reveals the extent of exploitation carried out by state-backed groups from China. Here are some key points regarding the incident:

– **Attackers**: The cyber-espionage campaign has been attributed to three Chinese state-backed groups known as Linen Typhoon, Violet Typhoon, and Storm-2603.
– **Targets**: Among the compromised entities are high-profile organizations such as the US National Nuclear Security Administration, various US government departments (Energy, Education, Revenue) and multiple European and Middle Eastern governments.
– **Vulnerability Exploitation**: The attackers exploited vulnerabilities in on-premises SharePoint servers, primarily aiming to steal authentication credentials and execute remote malicious code.
– **Growth of the Campaign**: There has been a dramatic increase in the number of affected organizations, jumping from 100 to around 400 in a very short timeframe, raising concerns about the visibility and detection of such threats.
– **Detection**: The campaign was initially detected on July 18 by Eye Security after identifying atypical activity on a customer’s server, suggesting that many attacks could go undetected.

This incident is a crucial reminder for IT and security professionals about the importance of:

– **Timely patching**: Regularly updating systems to close vulnerabilities.
– **Incident response preparedness**: Having measures in place to swiftly detect and respond to such breaches.
– **Monitoring and analysis**: Implementing thorough monitoring solutions to spot anomalies indicative of an attack.

The implications for security and compliance professionals are vast, as this breach not only affects individual organizations but also raises concerns regarding national security and the integrity of critical infrastructure.

1 10 2 24 3 4 5 7 a Act administration after Agency AI analysis and anomalies app art as at attack attackers attacks attribute authentication backed groups Bi breach breaches by C CERN China Chinese Chinese hacker Chinese hackers CI CIA CleaR co code compliance compliance professionals compromised concerns core credential credentials critical critical infrastructure Customer cyber cyber-espionage D de detection DoT dual e education energy espionage EU Europe European exp exploit Exploitation exploited vulnerabilities file for g Gen Global Go government government agencies government departments governments Group growth H hack hacker hackers high Highlight HR http HTTPS implications implications for security in incident incident response infrastructure integrity io ite J k Key l led Li Link M malicious code man management measures Micro Microsoft Microsoft SharePoint mid middle Middle East mini Monitor monitoring monitoring solutions multi N nation national security new news NGO NIST no non nuclear Nuclear Security o of on only organization organizations ory oS out over Patch Patch Management patching point pre premises preparedness pro professionals ps R Raise raising Rama RCE re red remote response revenue Risk risks Ro row s Scale sec security security and compliance security measure security measures security professionals server servers SHA SharePoint SharePoint Server SharePoint servers short Sig solutions source state Storm Swift system systems T ted the threat threats Time to Tor TP under up ups US uth V visibility vulnerabilities vulnerability Vulnerability Exploitation weapons Wi x z