Home › Threat Actors › Linen Typhoon
← All Threat Actors
Nation-State critical China (PRC)

Linen Typhoon

Chinese state-sponsored — PLA (People's Liberation Army) or contractor; assessed with high confidence based on 15+ years of documented activity, targeting alignment with Chinese strategic intelligence requirements, and shared tooling with other PRC-attributed actors · Espionage / strategic intelligence collection — telecommunications infrastructure, government, defence

Reports 1
Active Since 2010
Last Reported 22 Jul 2026
Sectors Targeted telecommunications, government, defense, technology

Tactics, Techniques & Procedures (TTPs)

  • SharePoint Server exploitation (CVE-2025-49706 SSRF + CVE-2025-49704 privilege escalation) for initial access and persistent web shell deployment
  • China Chopper web shell for initial persistence; replaced with stealthier mechanisms
  • HyperBro: DLL side-loading backdoor communicating via HTTPS through cloud/compromised legitimate websites
  • SysUpdate: modular backdoor with demand-loaded plugins (keylogging, credential harvesting, network scanning)
  • Lateral movement via PsExec, WMI, SMB, and RDP — standard Windows administration tools to blend with normal activity
  • Long dwell time (6 weeks to 8 months in documented intrusions) with sustained collection operations

Known Targets

North American telecommunications carriers (wireline and wireless)US federal civilian agenciesState-level government entitiesDefence contractors and aerospace firmsEuropean government ministriesAsian and Asia-Pacific government organisations

Analyst Notes

APT27/Linen Typhoon is one of the longest-continuously-operating Chinese state-sponsored APT groups with documented targeting of Western networks. Active since at least 2010, the group has maintained operations through multiple law enforcement actions, indictments of affiliated infrastructure operators, and vendor disruptions. A 2023 DOJ indictment named individuals associated with contractor infrastructure used by the group. The July 2026 SharePoint campaign targets organisations that have not applied Microsoft's December 2025 Patch Tuesday cumulative updates. The two-vulnerability chain (CVE-2025-49706 + CVE-2025-49704) enables unauthenticated RCE through session token extraction and privilege escalation — structurally similar to the Exchange ProxyLogon chain. Historical tooling includes PlugX, ZxShell, and HyperBro. Current tooling has shifted toward modular architectures (SysUpdate) that reduce on-disk footprint.

Also Known As

APT27UNC215 (Mandiant)EMISSARY PANDA (CrowdStrike)Bronze UnionLucky MouseIron Tiger

MITRE ATT&CK Techniques

T1190 Exploit Public-Facing Application (SharePoint CVE-2025-49706, CVE-2025-49704) T1505.003 Server Software Component: Web Shell (China Chopper) T1574.002 Hijack Execution Flow: DLL Side-Loading (HyperBro) T1047 Windows Management Instrumentation (lateral movement) T1021.001 Remote Services: Remote Desktop Protocol (lateral movement) T1560 Archive Collected Data

Intelligence Reports

Analysis telecommunicationsgovernment

Linen Typhoon: APT27's SharePoint Zero-Days and the Return to North American Networks

Microsoft tracks APT27 as Linen Typhoon. In July 2026, the group is exploiting two SharePoint vulnerabilities — CVE-2025-49706 and CVE-2025-49704 — against North American telecommunications and government targets. Active since 2010, this group's tools, patience, and institutional knowledge make it one of the most capable Chinese-attributed actors operating against Western targets.

22 Jul 2026 · 12 min read