Surprise, surprise: Chinese spies, IP stealers, other miscreants attacking Microsoft SharePoint servers

Microsoft reports active exploitation of chained SharePoint vulnerabilities (CVE-2025-53770 and CVE-2025-53771, linked to earlier CVEs) that enable authentication bypass and unauthenticated remote code execution; threat actors deploy web shells post-exploit. Attributed actors include Chinese-linked APTs Linen Typhoon (APT27), Violet Typhoon (APT31), and Storm-2603; fixes are available for SharePoint Server editions but public proofs-of-concept increase the likelihood of broader abuse, including ransomware.