China says US spies exploited Microsoft Exchange zero-day to steal military info

CNCERT/CC alleges that US intelligence exploited a Microsoft Exchange zero-day (July 2022–July 2023) to breach a major Chinese military enterprise—compromising its domain controller, controlling over 50 internal devices, and stealing emails containing defense-related designs—and that a separate July–November 2024 campaign used SQL injection and backdoors to compromise 300+ devices in communications and satellite internet sectors; the bulletin cites techniques such as WebSocket-over-SSH tunnels, covert channels, and use of international IP addresses to stage the intrusions.