China's Cyber Typhoons Blow Past Microsoft's Defenses, Wreaking Global Havoc

This is your Cyber Sentinel: Beijing Watch podcast. Listeners, it’s Ting back in your ears with Cyber Sentinel: Beijing Watch, and let me just say—if you were hoping for a boring cyber week, think again. Grab your coffee and your Yubikey, because Chinese cyber operators have pulled off what can best be described as an IT horror show, and security teams everywhere are sweating pixels. Let’s cut right to the breach. In early July, Chinese state-linked hackers, including familiar operator names like Linen Typhoon and Violet Typhoon, exploited serious new SharePoint vulnerabilities before Microsoft could even ship out the patches. The twist? The leak may have actually come from within Microsoft’s own Active Protections Program—meaning, someone with privileged access gave these state hackers a head start. Microsoft is running an internal review to see if their partner alert system became an express lane for attackers. That’s roughly 400 organizations compromised worldwide, with the National Nuclear Security Administration on the hit list. If you’re picturing men in black suits hitting panic buttons: you wouldn’t be wrong. Now, why does this matter beyond the smoke and sirens? This isn’t just a smash-and-grab. Chinese actors like Fire Ant and the aforementioned Typhoons are pioneering stealth—living off the land and planting backdoors that stay undetected for ages. Fire Ant, for example, has been exploiting VMware and F5 flaws, tunneling from guest OSes right through “segregated” network barriers, and dropping open-source rootkits like Medusa to ensure persistence. It’s the cyber equivalent of special ops behind enemy lines, only with fewer fingerprints and more Python scripts. US agencies have pretty much had to admit—again—that they must assume breach on all military networks, according to official advisories. That means, if it’s connected to the internet, it’s already compromised. The tactic isn’t just about stealing secrets: it’s about operational sabotage, influencing, and building long-term leverage inside critical infrastructure—think energy, telecom, water, and, of course, nuclear. It’s not a Tetris game—there are no neat lines to clear. The big brains in Beijing are not shy about denying all accusations, but the global aftermath says otherwise. Over in Europe, even UK intelligence has started telling industry to embrace a “the enemy is inside” mindset. Meanwhile, AI is giving attackers more ways to sift through loot, automate reconnaissance, and craft convincing disinformation as part of their arsenal. Kelly Perlroth, who’s previewing Black Hat this year, calls AI the new frontline—blurring the line between espionage and full-on influence ops. So, what’s a cyber defender to do? Here are my non-negotiables for this week: patch your on-prem SharePoint—yesterday if you can. Integrate antimalware scan interfaces, rotate your web app keys, and don’t forget to restart those servers. If you’re relying on network segmentation alone for defense, This content was created in partnership and with the help of Artificial Intelligence AI.