What is the Microsoft MAPP leak and how did Chinese hackers exploit SharePoint vulnerabilities?

A major cybersecurity incident unfolded in July 2025 as Microsoft launched an investigation into whether a leak from its Microsoft Active Protections Program (MAPP) allowed Chinese state-sponsored hackers to exploit critical SharePoint vulnerabilities before official patches were rolled out. The advanced attack, dubbed “ToolShell,” compromised over 400 global organizations, including the U.S. National Nuclear Security Administration, by stealing cryptographic machine keys and maintaining persistent unauthorized access. The zero-day flaw was first disclosed by a Vietnamese researcher at the Pwn2Own conference and was quickly exploited following MAPP notifications. This incident raises concerns over the integrity of Microsoft's vulnerability-sharing program and the growing sophistication of nation-state cyber threats.

Jul 28, 2025 - 09:55

Updated: 16 days ago

103.1k

What is the Microsoft MAPP leak and how did Chinese hackers exploit SharePoint vulnerabilities?

Quick answer: The Microsoft Active Protections Program (MAPP) shares vulnerability details with trusted security vendors before public release. Microsoft began investigating a suspected leak from it that may have given Chinese threat actors early access to SharePoint exploits. The attacks compromised over 400 organisations, including US federal agencies. Defenders should patch SharePoint quickly and hunt for compromise.

Key takeaways

MAPP gives trusted security vendors vulnerability details before release, so a leak there could help attackers move before patches.
Microsoft said it was investigating, so treat the link to the SharePoint attacks as suspected, not proven.
Patch SharePoint quickly and hunt for web shells regardless of how the exploit leaked.

What Happened in the Microsoft SharePoint Breach?
How Did the Exploit Work?
Timeline of the Attack and Key Events
Who Was Affected by the Attacks?
What is the Microsoft Active Protections Program (MAPP)?
Why This Incident Matters for Cybersecurity in 2026
Microsoft’s Response to the Incident
Chinese Government Response
What Should Organizations Do Now?
Global Security Implications
Conclusion

Microsoft has launched a critical investigation into a suspected leak from its Microsoft Active Protections Program (MAPP), which may have given Chinese threat actors early access to exploit dangerous SharePoint vulnerabilities. These exploits have since been used to compromise over 400 organizations worldwide, including top-tier U.S. federal agencies.

What Happened in the Microsoft SharePoint Breach?

In July 2025, Microsoft confirmed that attackers had exploited a SharePoint zero-day vulnerability, revealed earlier at the Pwn2Own Berlin 2025 event by Vietnamese researcher Dinh Ho Anh Khoa. While patches were distributed shortly after, the timing of initial exploitation raises concerns that confidential information may have been leaked from Microsoft’s own MAPP program.

What is the Microsoft MAPP leak and how did Chinese hackers exploit SharePoint vulnerabilities?

How Did the Exploit Work?

Exploiting SharePoint Through Authentication Bypass and Key Theft

The attackers deployed a multi-stage attack chain named "ToolShell" which:

Bypassed authentication mechanisms in SharePoint.
Executed remote code on unpatched or partially patched servers.
Extracted machine-level cryptographic keys, enabling long-term persistent access, even after patches were applied.

The vulnerability's severity lies in its post-patch persistence, allowing attackers to survive even after systems were updated.

Timeline of the Attack and Key Events

Date	Event Description
May 2025	Vulnerability demonstrated at Pwn2Own Berlin by Dinh Ho Anh Khoa
June 24	First MAPP partner notification sent by Microsoft
July 3–7	Final MAPP notifications issued
July 7	Microsoft detects first exploitation attempts in the wild
July 18	SharePoint zero-day hits U.S. Department of Energy, including the NNSA

This suspicious timeline triggered concerns that someone within MAPP may have weaponized the exploit using privileged access.

Who Was Affected by the Attacks?

According to Eye Security, the cybersecurity firm that uncovered the attacks, the breach impacted:

Government agencies (including U.S. Department of Energy and NNSA)
Energy infrastructure providers
Educational institutions
Private corporations in North America, Europe, and Asia

Attribution to Chinese APT Groups

Microsoft attributed the breaches to three Chinese nation-state actors:

Linen Typhoon
Violet Typhoon
Storm-2603

These groups have a known history of cyber espionage targeting critical infrastructure and intellectual property.

What is the Microsoft Active Protections Program (MAPP)?

MAPP is a 17-year-old information-sharing initiative by Microsoft designed to give select security partners advance notice of vulnerabilities, ranging from 24 hours to 5 days before public disclosure. While the intention is defensive, it becomes dangerous if leaked to malicious actors.

Past MAPP Breaches

2012: Chinese firm Hangzhou DPtech Technologies leaked proof-of-concept code.
2020s: Qihoo 360 was removed after being listed on the U.S. Entity List.

There are currently at least a dozen Chinese companies in the MAPP program, increasing the risk of insider misuse.

Why This Incident Matters for Cybersecurity in 2026

Strategic Risk to National Security

The exploitation of a vulnerability affecting SharePoint, a platform used by countless organizations globally, including U.S. nuclear agencies, shows the catastrophic potential of information leaks from trusted security programs.

Diminishing Trust in Vendor Early Access Programs

A confirmed leak would call into question the integrity of early-warning systems like MAPP and may limit future collaborations between vendors and researchers.

Microsoft’s Response to the Incident

Microsoft issued the following statement:

“As part of our standard process, we’ll review this incident, find areas to improve, and apply those improvements broadly. Partner programs like MAPP remain an important part of the company’s security response.”

The company has not yet confirmed the leak but is actively investigating all internal access and partner disclosures.

Chinese Government Response

The Chinese Embassy in Washington denied involvement:

“China opposes and fights hacking activities in accordance with the law and rejects smears against China under the excuse of cybersecurity issues,” said Foreign Ministry spokesman Guo Jiakun.

What Should Organizations Do Now?

Recommendations for Defense

To mitigate risks from similar SharePoint vulnerabilities:

Immediately apply the latest security patches from Microsoft.
Use network segmentation and strong firewall rules to isolate SharePoint services.
Monitor for anomalous traffic, especially unauthorized key access or authentication bypass attempts.
Deploy threat-hunting tools like Microsoft Defender for Endpoint, Sysmon, and SIEM solutions.

Global Security Implications

This incident goes beyond Microsoft: it reveals a global cybersecurity governance challenge, where:

Vendor-trusted partners might become insider threats.
Exploit timelines can outpace patch adoption.
Nation-states weaponize legitimate disclosures faster than ever before.

As threat actors increasingly weaponize disclosed vulnerabilities, governments and enterprises must reassess the balance between transparency and operational risk.

Conclusion

The Microsoft SharePoint vulnerability incident is a wake-up call for global cybersecurity infrastructure. The suspected leak from MAPP and the precision of exploitation by advanced Chinese threat groups reveal the fragile trust ecosystem between tech vendors, researchers, and nation-states. While Microsoft continues its investigation, organizations must move quickly to patch, monitor, and reduce reliance on exposed platforms. In the age of supply chain attacks and insider risks, zero-day preparedness and careful sharing protocols have never been more important.

Reference

For the authoritative details, see National Vulnerability Database.

Frequently Asked Questions

The Microsoft Active Protections Program (MAPP) is a partnership initiative where Microsoft shares early vulnerability information with trusted security vendors to help them prepare defensive measures before public disclosure.

Attackers exploited authentication bypass flaws in Microsoft SharePoint that allowed them to steal cryptographic machine keys and execute remote code on servers.

The vulnerability was first demonstrated by Vietnamese researcher Dinh Ho Anh Khoa at the Pwn2Own 2025 cybersecurity conference in Berlin.

MAPP partners were alerted in waves, on June 24, July 3, and July 7. Notably, Microsoft detected exploitation starting July 7.

ToolShell is the name of the sophisticated exploit chain that allows attackers to gain access and maintain persistence on SharePoint servers using stolen cryptographic keys.

Microsoft attributed the campaign to three Chinese state-sponsored groups: Linen Typhoon, Violet Typhoon, and Storm-2603.

Yes, the NNSA was one of the high-profile victims, although officials stated that no classified data was compromised.

More than 400 organizations across government, education, energy, and private sectors globally were affected by this campaign.

Premature disclosure can allow malicious actors to exploit the vulnerabilities before companies have a chance to patch systems, resulting in zero-day attacks.

Eye Security monitored unusual SharePoint activity and reported four waves of exploitation across hundreds of systems.

Yes. In 2012 and more recently in 2020, Microsoft removed Chinese firms from MAPP for leaking vulnerability data.

Microsoft confirmed it is reviewing the incident and pledged to improve its partner program security and protocols.

The Chinese Embassy denied involvement and criticized any allegations of state-sponsored hacking as politically motivated.

It is a sensitive key used by systems to encrypt data. If stolen, attackers can impersonate services or maintain persistent access.

Regular patching, restricting external SharePoint access, and monitoring authentication logs can help reduce the attack surface.

The U.S. Department of Energy reported minimal impact due to its adoption of Microsoft’s cloud infrastructure.

Government, education, energy, and commercial sectors across North America, Europe, and Asia were targeted.

Yes, if the leak is confirmed, it would undermine trust in Microsoft’s MAPP and its ability to protect pre-disclosure information.

Because attackers stole cryptographic keys, they could maintain access even after the vulnerability was fixed, unless keys were rotated.

It was a zero-day at the time of exploitation, as attackers used it before the public had access to Microsoft’s patches.

It is a prestigious cybersecurity contest where researchers demonstrate new zero-day vulnerabilities to responsibly disclose them.

Dinh Ho Anh Khoa earned $100,000 for demonstrating the SharePoint vulnerability.

It’s a trade restriction list of companies the U.S. deems a threat to national security or foreign policy.

Eye Security was the first to identify and report the active SharePoint exploit campaign.

Yes, access to sensitive SharePoint servers could allow data exfiltration, lateral movement, and long-term surveillance.

No. It was known only to Microsoft and MAPP partners until patches were released, which is why a leak is suspected.

Microsoft issued initial patches in July, shortly after internal alerts and external signs of exploitation.

Not always, which is why their compromise can be particularly damaging if not addressed during incident response.

The attackers exploited logic flaws in the authentication process that allowed them to impersonate trusted users.

Microsoft observed exploit attempts on the very day of the final notification wave, July 7, 2025.

Vulnerability disclosure programs need stricter controls, and organizations must patch rapidly while monitoring for early exploitation signs.

Interested in this course? Get a callback from our experts.

Tags:

How to Automate Recon and Detect Subdomain Takeovers with Amass, Subfinder an...

What's Your Reaction?

Like 0

Dislike 0

Love 0

Funny 0

Wow 0

Sad 0

Angry 0

Vaishnavi

Vaishnavi is a skilled tech professional at the Ethical Hacking Training Institute in Pune, responsible for managing and optimizing the technical infrastructure that supports advanced cybersecurity education. With deep expertise in network security, backend operations, and system performance, she ensures that practical labs, online modules, and assessments run smoothly and securely. Her behind-the-scenes contributions play a vital role in delivering a seamless and secure learning experience for aspiring ethical hackers.