Silk Typhoon Targeting IT and Cloud Applications (Campaign)

Microsoft Threat Intelligence reports that Silk Typhoon, a Chinese state-sponsored espionage group, is increasingly targeting IT supply-chain components, remote management tools, and cloud applications—exploiting zero-days (notably CVE-2025-0282) and exposed credentials to gain initial access, establish persistence (web shells, account resets), move laterally from on-premises to cloud (via AADConnect), abuse service principals and multi-tenant apps, and exfiltrate data from Exchange Online, OneDrive, and SharePoint.