China's Silk Typhoon APT Shifts to IT Supply Chain AttacksChina's Silk Typhoon APT Shifts to IT Supply Chain Attacks

The China-backed cyber-espionage group known as "Silk Typhoon" has begun targeting organizations in the IT supply chain to gain access to their downstream customers.

The activity signals a troubling shift in the threat group's tactics, making detection and mitigation more challenging for victims because the attacks exploit trusted relationships and bypass traditional security defenses.

Silk Typhoon's Shift in Cyber Tactics

Researchers at Microsoft, who have tracked the threat activity since late 2024, identified Silk Typhoon actors as primarily targeting providers of remote management tools, cloud applications, identity management, and privileged access management (PAM) platforms in their latest campaign.

"While they haven’t been observed directly targeting Microsoft cloud services, they do exploit unpatched applications that allow them to elevate their access in targeted organizations and conduct further malicious activities," Microsoft said in a threat intelligence blog post today.

The campaign has included harvesting API keys and credentials associated with PAM platforms, cloud app providers, and cloud data management companies, Microsoft said. Silk Typhoon then uses the stolen keys and credentials to infiltrate the networks of downstream customers of those IT service providers.

Read the Full Story on Dark Reading >>>