Microsoft Blocks Chinese Companies After SharePoint Hack Leak

Microsoft has severed cybersecurity partnerships with Chinese companies following a devastating leak that enabled state-sponsored hackers to exploit SharePoint vulnerabilities across hundreds of organizations worldwide.

The tech giant implemented restrictions in July 2025 after investigating suspicious timing between vulnerability notifications and subsequent attacks.

The decision affects Chinese firms participating in Microsoft's Active Protections Program (MAPP), which provides advance security intelligence to select partners.

Over 400 organizations fell victim to the resulting cyberattacks, including critical US federal agencies and private enterprises.

Timeline Reveals Suspicious Coordination

Microsoft notified MAPP partners about SharePoint vulnerabilities on June 24, July 3, and July 7. Remarkably, exploitation attempts began on July 7, the exact day of the final notification wave.

This timing raised immediate red flags among cybersecurity investigators. Dustin Childs from Trend Micro's Zero Day Initiative called the timeline highly suspicious.

The rapid exploitation suggested someone within MAPP leaked vulnerability details to enable the attacks. Three Chinese hacking groups executed the campaign: Linen Typhoon, Violet Typhoon, and Storm-2603.

Did you know?
Microsoft's MAPP program has operated for 17 years, but this marks the first time an entire country's participants have faced systematic restrictions due to suspected state-sponsored misuse.

Federal Agencies Among Victims

The sophisticated cyberattack compromised numerous high-value targets, including the Department of Homeland Security, National Nuclear Security Administration, and Department of Education.

The scale and precision of the attacks demonstrated advanced planning and insider knowledge of the vulnerabilities.

Microsoft spokesperson David Cuddy confirmed restrictions now apply to participants in countries requiring vulnerability reporting to governments.

This directly targets China's 48-hour reporting mandate, which creates potential conflicts between commercial partnerships and state intelligence gathering.

ALSO READ | How Fast Is China Deploying Its Guowang Satellites Compared to Starlink?

Pattern of Previous Breaches

This represents the third major MAPP breach involving Chinese participants since 2012. Microsoft previously removed Hangzhou DPtech Technologies for leaking a proof-of-concept code and violating non-disclosure agreements.

In 2021, suspected leaks enabled the Hafnium group's global Exchange server attacks.

Chinese MAPP partners face inherent conflicts of interest due to mandatory government reporting requirements.

Some participants, including Beijing CyberKunlun Technology, simultaneously contribute to China's government-run vulnerability database overseen by the Ministry of State Security.

Proof-of-Concept Access Eliminated

Under new restrictions, affected Chinese firms lose access to proof-of-concept code that mimics malicious software operations.

While legitimate security professionals use this code to bolster defenses, misuse can turn it into a weapon to speed up cyberattacks.

Microsoft emphasized its ongoing vigilance against information misuse, stating it takes both public and confidential steps to prevent exploitation.

The company continually reviews participants and removes those violating contractual obligations, including prohibitions on offensive cyber operations.

The restrictions signal a fundamental shift in Microsoft's global cybersecurity strategy, prioritizing security over international cooperation as geopolitical tensions intensify around critical technology infrastructure.