Who Is Linen Typhoon
APT27, tracked as Linen Typhoon by Microsoft, UNC215 by Mandiant, and EMISSARY PANDA by CrowdStrike, is one of the most established and capable Chinese state-sponsored threat groups operating against Western targets. The group has been conducting espionage operations since at least 2010, making it one of the longest-continuously-operating APT actors with documented targeting of US, European, and Asia-Pacific government and enterprise networks.
The group’s sponsorship is assessed with high confidence to be the People’s Liberation Army (PLA) or a contractor operating in support of Chinese state intelligence collection requirements. The targeting pattern across more than 15 years of documented activity consistently aligns with strategic intelligence priorities: telecommunications infrastructure, government ministries, defence contractors, aerospace companies, and technology firms with intellectual property relevant to Chinese industrial and military development programmes.
APT27 is not the most technically sophisticated Chinese APT. Groups like APT41 have demonstrated more complex multi-stage supply chain operations, and Salt Typhoon has shown deeper telecommunications network access. What APT27 brings is durability, institutional knowledge of victim environments built over years of sustained access, and a well-developed toolkit that it adapts to new exploitation opportunities when they arise. The July 2026 SharePoint campaign is an example of that pattern: an established actor with standing access to victim environments weaponising new vulnerabilities to extend or recover access.
The July 2026 SharePoint Campaign
SharePoint Server is a pervasive Microsoft collaboration platform deployed across government agencies, large enterprises, and telecommunications companies. It is frequently internet-accessible, trusted within corporate networks, and integrated with Active Directory in ways that make it a high-value persistence and lateral movement target once compromised.
In July 2026, Mandiant and CrowdStrike independently identified active exploitation of two SharePoint vulnerabilities by UNC215/EMISSARY PANDA:
CVE-2025-49706 (CVSS 9.0) is an SSRF (Server-Side Request Forgery) vulnerability in SharePoint Server’s OAuth token validation endpoint. A crafted request can cause the SharePoint server to make HTTP requests to attacker-specified internal endpoints, bypassing authentication and allowing the attacker to interact with services that should not be reachable from the internet. In the observed exploitation, the SSRF is used to reach internal authentication endpoints and obtain authentication artefacts that the attacker then uses to authenticate as a privileged SharePoint service account.
CVE-2025-49704 (CVSS 8.0) is a privilege escalation vulnerability in SharePoint’s site administration functionality. An attacker with any authenticated SharePoint user account can leverage this vulnerability to elevate to a SharePoint administrator within a target site collection, gaining the ability to upload and execute ASPX web shells via SharePoint’s legitimate file management capabilities.
The two vulnerabilities chain effectively: CVE-2025-49706 provides authentication as a service account without requiring valid user credentials, and CVE-2025-49704 escalates that service account’s SharePoint permissions to administrator level. The result is unauthenticated remote code execution on the SharePoint server through the web shell deployment path, without requiring any credential brute force or phishing.
Microsoft released patches for both vulnerabilities in December 2025 as part of Patch Tuesday. The July 2026 exploitation campaign is targeting organisations that have not applied the December 2025 patches or the January 2026 cumulative updates, a depressingly common situation for SharePoint deployments where update cycles are slow due to customisation complexity.
Post-Exploitation Toolkit
APT27’s toolkit has evolved significantly from the early days of PlugX and ZxShell. Current observed tooling in the July 2026 campaign includes:
HyperBro remains a core implant. It is a DLL-based backdoor that uses DLL side-loading for execution, typically abusing legitimate signed executables to load the malicious library. HyperBro provides remote command execution, file system operations, and network tunneling capability. It communicates over HTTPS with C2 infrastructure that is typically hosted on commercial cloud providers or compromised legitimate websites, making outbound traffic difficult to distinguish from normal business traffic.
SysUpdate is a more recently observed modular backdoor. Its modular architecture allows the operator to load specific capability plugins (keylogging, credential harvesting, network scanning, lateral movement) on demand, reducing the on-disk footprint of any single infection and complicating forensic analysis.
China Chopper web shell remains in use for initial persistence after SharePoint exploitation. Despite being a publicly known and widely detected web shell, it continues to appear in APT27 intrusions. The group appears to use it as a fast-deploy initial foothold, knowing detection is likely, and replaces it with more stealthy persistent access mechanisms before the initial foothold is discovered.
Lateral movement within victim networks uses standard Windows mechanisms: PsExec, WMI remote execution, SMB file sharing, and RDP. The group uses legitimate Windows administrative tools extensively to blend activity with normal IT operations.
Targets and Objectives
The July 2026 campaign targets align with APT27’s historical priorities. Mandiant identified confirmed intrusions at:
North American telecommunications carriers: Both wireline and wireless operators. The intelligence collection interest in telecom operators reflects several objectives: call detail records and subscriber data, network topology information useful for planning future operations, and the potential to pre-position access for disruption operations. Salt Typhoon’s deep penetration of US carrier networks, documented in late 2024 and 2025, likely increased pressure on Chinese intelligence requirements to maintain and expand telecom sector access through additional pathways.
Government agencies: Federal civilian agencies and state-level government entities with roles in national security, economic policy, and diplomatic functions. Document management, email correspondence, and internal communications systems accessible via SharePoint are the primary collection targets.
The dwell time before detection in analysed intrusions ranged from six weeks to approximately eight months, consistent with APT27’s historical patience in victim environments. The group conducts sustained collection over time rather than grabbing data and leaving, building up a comprehensive intelligence picture from a compromised environment.
Historical Context
Understanding APT27’s history matters for assessing the July 2026 campaign’s significance. This group has operated against US and allied targets through multiple periods of exposure, diplomatic pressure, and apparent disruption, each time reconstituting and returning.
The 2021 Microsoft Exchange exploitation (CVE-2021-26855 and related vulnerabilities) included APT27 among the groups that exploited the zero-days before patching. The 2022-2025 period saw multiple private-sector reports linking APT27 infrastructure to intrusions at defence contractors, manufacturing companies, and government agencies across Western countries. A 2023 DOJ indictment named individuals associated with the group’s contractor infrastructure.
None of these actions stopped the group’s operations. The July 2026 SharePoint campaign is a continuation of sustained collection operations that have run uninterrupted for over a decade, adjusting to new vulnerability opportunities as they arise.
Remediation and Detection
Patch SharePoint immediately. Apply the December 2025 Patch Tuesday cumulative update or the January 2026 or later cumulative updates if you are behind. Microsoft’s Security Update Guide provides the specific update packages for each supported SharePoint version. If your SharePoint environment runs customisations that have delayed patching, assess the risk of deferral against the active exploitation of these vulnerabilities by a capable state-sponsored actor.
Audit web shell presence. Check SharePoint site asset libraries, IIS wwwroot directories, and SharePoint application directories for unexpected ASPX files. APT27’s China Chopper web shells are typically named with innocuous-looking filenames that blend with legitimate SharePoint assets.
Review SharePoint admin and service account activity. Unusual permission grants, new site collection administrators added without documented change requests, and service account authentication from unexpected source IPs are indicators of exploitation via the vulnerability chain.
Monitor HyperBro indicators. Known HyperBro C2 infrastructure indicators and DLL side-loading patterns are documented in multiple threat intelligence feeds. Endpoint detection should look for legitimate signed executables (particularly legitimate security software and antivirus utilities) loading unexpectedly modified companion DLLs.
Segment SharePoint from sensitive internal systems. SharePoint servers that are internet-accessible should have limited ability to reach sensitive internal network segments and domain controllers. Network segmentation does not prevent initial exploitation but limits the pivot capability an attacker gains from a compromised SharePoint server.