Chinese Silk Typhoon Hackers Exploited Commvault Zero-Day

Xuất bản: 22/8/2025

Chinese state-sponsored hacking group Silk Typhoon has been intensifying its attacks against entities in North America, CrowdStrike says.

The APT, which has been blamed for the 2024 US Treasury hack, was seen attacking high-profile targets within the government, technology, academic, legal, and professional services sectors, for intelligence gathering.

CrowdStrike, which tracks the group as Murky Panda, observed the hackers rapidly weaponizing n-day and zero-day vulnerabilities for initial access to victims’ environments. They also appear to have compromised SOHO routers, to abuse them as infrastructure in attacks.

“The adversary has leveraged trusted-relationship compromises in the cloud and demonstrated a high level of operations security (OPSEC), including modifying timestamps and deleting indicators of their presence in victim environments to avoid detection and hinder attribution efforts,” CrowdStrike notes.

Silk Typhoon was seen targeting Citrix NetScaler ADC and NetScaler Gateway instances affected by CVE-2023-3519, as well as CVE-2025-3928, a Commvault vulnerability exploited as a zero-day to compromise Microsoft Azure instances.

Commvault learned of the zero-day attacks after Microsoft warned it of state-sponsored attacks against customer environments. Its investigation revealed that the zero-day was exploited to steal credentials stored by Commvault, which were then used to access the victims’ M365 environments.

“In at least two cases analyzed by CrowdStrike, Murky Panda exploited zero-day vulnerabilities to achieve initial access to software-as-a-service (SaaS) providers’ cloud environments. Following the compromise, Murky Panda determined the compromised SaaS cloud environments’ logic, enabling them to leverage their access to that software to move laterally to downstream customers,” CrowdStrike explains.

The Chinese APT was also seen compromising a Microsoft cloud solution provider that had cross-tenant access to a downstream customer, obtaining global administrator privileges and then escalating those privileges to access email accounts, likely for information-gathering purposes.

Advertisement. Scroll to continue reading.

Silk Typhoon was also seen relying on RDP, web shells, and, occasionally, on malware such as CloudedHope, for lateral movement and persistence. Developed in Golang, CloudedHope has basic remote access tool (RAT) functionality.

“Organizations that rely heavily on cloud environments are innately vulnerable to trusted-relationship compromises in the cloud. China-nexus adversaries such as Murky Panda continue to leverage sophisticated tradecraft to facilitate their espionage operations, targeting numerous sectors globally,” CrowdStrike notes.