China-linked Silk Typhoon Hackers Target SaaS Providers, Zero Days

Silk Typhoon, a China-linked APT group, exhibits rare capabilities in compromising trusted cloud relationships and rapidly weaponizing vulnerabilities. Their tactics include supply chain attacks, exploiting zero-day vulnerabilities, and using compromised SOHO devices to mask malicious activity. #SilkTyphoon #MurkyPanda #SupplyChainAttacks #ZeroDayVulnerabilities

Keypoints

Silk Typhoon is known for targeting cloud environments through trusted-relationship compromises.
The group uses zero-day vulnerabilities, such as CVE-2023-3519 and CVE-2025-3928, to gain initial access.
They have conducted supply chain attacks on SaaS providers, including exploiting application secrets and delegated admin privileges.
Malware like CloudedHope and tools like Neo-reGeorg facilitate lateral movement and persistence within networks.
CrowdStrike recommends monitoring Entra ID activities and auditing credentials to detect Silk Typhoon’s operations.