Silk Typhoon targeting IT supply chain

Microsoft Threat Intelligence details Silk Typhoon — a well-resourced Chinese state-aligned espionage actor — describing how the group exploits zero-days and unpatched remote management, VPN, and cloud-related products, abuses stolen API keys and credentials to access downstream customer tenants, moves laterally into cloud environments (including targeting Entra/AADConnect and service principals), and exfiltrates sensitive email and SharePoint data; the report provides observed CVEs, IoCs, detection queries, and specific mitigation and hunting guidance.