Chinese state-sponsored threat actors, including groups known as Linen Typhoon, Violet Typhoon, and Storm-2603, have exploited vulnerabilities in Microsoft’s SharePoint servers, affecting over 400 agencies and organizations worldwide. These cyberattacks have primarily targeted entities in the U.S., including the National Nuclear Security Administration (NNSA), as well as organizations in Europe and the Middle East. The attacks involved exploiting a Microsoft SharePoint zero-day vulnerability chain, known as ToolShell, to gain unauthorized access and steal key materials. Microsoft and Google have linked these widespread attacks to Chinese nation-state actors, with Microsoft releasing security updates and advising on-premises SharePoint users to install them promptly. The vulnerabilities allow attackers to spoof authentication credentials and execute malicious code remotely, posing significant risks to unpatched systems. The NNSA, part of the Department of Energy, confirmed the breach but noted minimal impact due to its use of Microsoft’s M365 cloud and robust cybersecurity measures. Other affected entities include the U.S. Department of Education, Florida’s Department of Revenue, and the Rhode Island General Assembly. Microsoft has expressed “medium confidence” in Storm-2603’s ties to China and warned of additional actors potentially exploiting these vulnerabilities. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has mandated federal agencies to secure their systems against these threats, emphasizing the urgency in addressing the vulnerabilities.