Silk Typhoon Attacks North American Orgs in the Cloud

Silk Typhoon (also known as Hafnium/Murky Panda), a China-linked APT, has shifted to cloud and supply-chain operations where it compromises SaaS providers, service principals, and managed service provider accounts to access downstream customers' environments. The group has exploited high-severity vulnerabilities (including CVE-2023-3519) and used a Golang RAT called CloudedHope to establish persistence and exfiltrate emails and intelligence from government, technology, academic, legal, and professional services organizations across North America, highlighting risks in broad cloud trust relationships.