Chinese state-sponsored Espionage Group Silk Typhoon Targets IT Supply Chain

Breached Company

06 Mar 2025 — 7 min read

Microsoft has identified a significant shift in tactics by the Chinese state-sponsored espionage group Silk Typhoon (also tracked as HAFNIUM), which now targets IT supply chains and cloud applications to breach downstream organizations14. This technical brief outlines their evolving tradecraft, historical patterns, and mitigation strategies.

Executive Summary

Silk Typhoon has transitioned from direct exploitation of edge devices to supply chain compromises, leveraging stolen API keys, credentials, and zero-day vulnerabilities in IT management tools. Their objectives include espionage, data exfiltration, and lateral movement across cloud environments. Recent campaigns focus on MSPs, PAM providers, and cloud app vendors to infiltrate government, defense, healthcare, and energy sectors globally14 20.

Recent Activity & Tradecraft

Initial Access

Supply Chain Compromise: Abuse of stolen API keys/credentials from IT service providers (e.g., RMM, PAM, cloud data management) to access downstream customers14.
Zero-Day Exploits: Rapid operationalization of vulnerabilities like CVE-2025-0282 (Ivanti Pulse Connect VPN) and historical exploits in Palo Alto Networks’ GlobalProtect (CVE-2024-3400) and Citrix NetScaler (CVE-2023-3519)13 11.
Credential Harvesting: Password spraying, GitHub reconnaissance for leaked credentials, and abuse of dormant administrative accounts14.

Post-Compromise Tactics

Lateral Movement to Cloud:
- Targeting Microsoft Entra Connect servers to synchronize on-premises Active Directory with cloud environments116.
- Dumping Active Directory, stealing credentials from key vaults, and escalating privileges4 11.
OAuth/Service Principal Abuse:
- Adding malicious passwords to consented applications for data exfiltration via Microsoft Graph API (email, OneDrive, SharePoint)111.
- Creating multi-tenant Entra ID applications with names mimicking legitimate services (e.g., "Office 365 Backup")14.
Log Manipulation: Clearing logs post-activity to evade detection14.

Covert Infrastructure

CovertNetwork: Egress traffic routed through compromised devices (Cyberoam appliances, Zyxel routers, QNAP NAS)13.
Short-lived VPS infrastructure for command-and-control1.

Historical Exploitation Patterns

Silk Typhoon has a track record of exploiting zero-days in public-facing services:

Vulnerability	Product	Impact
CVE-2021-26855	Exchange Server	SSRF → RCE as SYSTEM14
CVE-2024-3400	Palo Alto PAN-OS	Unauthenticated RCE13
CVE-2023-3519	Citrix NetScaler	Unauthenticated RCE111
CVE-2025-0282	Ivanti Pulse Connect	Privilege escalation13

Web shells like China Chopper and AspxSpy were deployed for persistence during earlier campaigns111.

Detection & Mitigation

Hunting Guidance

Entra Connect Servers: Monitor for anomalous password resets, user creation, or sync anomalies116.
Service Principals: Audit for new secrets, unused apps accessing APIs, and Graph/EWS data exfiltration14.
VPN Logs: Investigate unpatched Ivanti/Citrix/Palo Alto devices for configuration changes during exploitation windows13.

Microsoft Defender XDR Integration

Alerts: "Silk Typhoon activity group," "Suspicious Entra sync password change," "Anomalous MailItem access via GraphAPI"1.
Sentinel Queries: Deploy analytics for web shells, password sprays, and key vault access anomalies111.

Critical Recommendations

Patch Public-Facing Systems: Prioritize Ivanti, Citrix, and Exchange servers13.
Enforce Zero Trust:
- Restrict on-premises service accounts from cloud resource access1.
- Implement Conditional Access policies and risk-based MFA14.
Audit OAuth Apps:
- Remove unnecessary EWS permissions (EWS.AccessAsUser.All, EWS.full_access_as_app)1.
- Use Microsoft’s App Governance to detect anomalous API activity111.
Credential Hygiene: Rotate passwords exposed via GitHub/leaks and enforce MFA for admin accounts14.

Microsoft Security Tooling

Defender Vulnerability Management: Identify unpatched systems (CVE-2025-0282, ProxyLogon)1.
Security Copilot: Automate incident response with pre-built prompts (e.g., "Threat actor profile")1.
External Attack Surface Management: Detect vulnerable edge devices via Attack Surface Insights1.

Silk Typhoon’s adaptability underscores the need for layered defenses, particularly in hybrid cloud environments. Organizations should assume breach and validate detection capabilities against the TTPs outlined in Microsoft’s full report14 20.

For ongoing updates, follow Microsoft Threat Intelligence1.

What specific vulnerabilities has Silk Typhoon exploited recently

Silk Typhoon, a Chinese state-sponsored espionage group, has recently exploited several critical vulnerabilities in IT infrastructure to enable supply chain attacks and cloud environment infiltration. Below is a detailed breakdown of their active and historical exploitation patterns, with a focus on recent campaigns:

Recent Exploited Vulnerabilities (2024–2025)

Product/Service	Vulnerability Type	Impact
Ivanti Pulse Connect VPN	Privilege Escalation Zero-Day	Unauthorized access to downstream entities via VPN appliances1 3 5 7
Palo Alto PAN-OS	Unauthenticated RCE	Exploited to breach GlobalProtect Gateways and deploy web shells1 6 7
Citrix NetScaler ADC/Gateway	Unauthenticated RCE	Used to execute arbitrary code on unpatched Citrix appliances1 3 7

Key Campaigns and Tactics

Ivanti Pulse Connect VPN (CVE-2025-0282)
- Exploited in January 2025 to breach MSPs and government agencies.
- Enabled lateral movement into cloud environments via Entra Connect servers1 5.
Palo Alto PAN-OS (CVE-2024-3400)
- Targeted unpatched firewalls for initial access, followed by data exfiltration via Microsoft Graph API6 7.
Citrix NetScaler (CVE-2023-3519)
- Leveraged for credential harvesting and deployment of web shells like China Chopper3 7.

Historical Vulnerabilities Still Actively Exploited

CVE	Product/Service	Notes
	Microsoft Exchange	ProxyLogon exploit chain (SSRF → RCE). Actively scanned by GreyNoise as of March 202567.
	Apache Log4j	Log4Shell exploited for cloud-to-on-premises pivoting6.

Post-Exploitation Techniques

Cloud Lateral Movement: Targeting Microsoft Entra Connect servers to synchronize on-premises AD with cloud environments, enabling credential dumping and privilege escalation1 3.
OAuth Application Abuse: Hijacking service principals to exfiltrate email, SharePoint, and OneDrive data via Microsoft Graph API3 7.
Log Manipulation: Deleting logs post-compromise to evade detection1 4.

Mitigation Recommendations

Patch Prioritization: Immediately apply updates for Ivanti, Palo Alto, and Citrix systems.
Credential Hygiene: Rotate API keys, enforce MFA, and audit GitHub for leaked credentials2 5.
Cloud Monitoring: Hunt for anomalous Entra Connect sync activity and OAuth app permissions1 7.

Silk Typhoon’s rapid weaponization of zero-days underscores the need for proactive vulnerability management. Organizations should assume breach and validate defenses against these TTPs.

What are the key tactics used by Silk Typhoon in their supply chain attacks

Silk Typhoon, a Chinese state-sponsored espionage group, has refined its tradecraft to exploit IT supply chains through sophisticated tactics. Below is an analysis of their key methods based on recent campaigns:

Supply Chain Targeting

API Key & Credential Abuse: Compromising IT service providers (e.g., PAM, RMM, cloud app vendors) to steal API keys and credentials, enabling access to downstream customers like government agencies and IT firms1 4 6.
Multi-Tenant Cloud Apps: Hijacking administrative access to cloud data management platforms for lateral movement into customer environments4 8.

Initial Access Techniques

Zero-Day Exploits: Rapid weaponization of vulnerabilities:
- CVE-2025-0282 (Ivanti Pulse Connect VPN): Privilege escalation for unauthenticated RCE1 2 4.
- CVE-2024-3400 (Palo Alto PAN-OS): Command injection in GlobalProtect Gateways2 3.
- CVE-2023-3519 (Citrix NetScaler): Unauthenticated RCE for web shell deployment2 3.
Credential Harvesting:
- Password spraying and brute-forcing dormant accounts1 4.
- Scraping GitHub for leaked corporate credentials4 6.

Lateral Movement & Cloud Exploitation

Entra Connect Server Targeting: Compromising synchronization tools to bridge on-premises AD with cloud environments, enabling credential dumping and privilege escalation4 5 8.
OAuth/Service Principal Abuse: Creating malicious Entra ID applications (e.g., "Office 365 Backup") to exfiltrate data via Microsoft Graph API (email, SharePoint, OneDrive)3 8.

Persistence & Evasion

Web Shells: Deploying China Chopper and AspxSpy for command execution2 3.
User Account Manipulation: Resetting default admin accounts and creating new users to maintain access1 4.
Log Deletion: Erasing activity logs post-compromise to evade detection1 4.

Infrastructure

CovertNetwork: Routing traffic through compromised devices (Cyberoam, Zyxel routers, QNAP NAS)3 9.
Short-Lived VPS: Using ephemeral cloud infrastructure for C2 operations3.

Strategic Shift

Silk Typhoon has pivoted from direct edge-device exploits to supply chain-centric campaigns, prioritizing IT providers to maximize access to high-value targets. This shift mirrors historical breaches like SolarWinds and MOVEit1 5. Their adaptability underscores the need for:

Zero Trust Policies: Restricting service account privileges and enforcing MFA4 6.
Cloud Monitoring: Hunting for anomalous Graph API activity and Entra ID sync anomalies8.
Patch Management: Prioritizing updates for Ivanti, Citrix, and Palo Alto systems2 3.

Organizations must assume breach and validate defenses against these evolving TTPs.