Silk Typhoon exploits cloud trust to reach downstream tenants

A Chinese state-backed threat group known as Silk Typhoon, also called Murky Panda, has accelerated its cyber espionage campaign against North American government, technology, legal, and professional services entities. The group has increasingly exploited trusted relationships in cloud environments to reach downstream customers, escalating activity since late spring and highlighting a shift toward cloud-centric attack methods that bypass traditional perimeter controls.

Experts describe a multi-stage approach that begins with initial access through exposed internet-facing devices and vulnerabilities, then pivots into managed cloud environments via trusted relationships with cloud service providers. In several recent intrusions, the attackers leveraged zero-day and day vulnerabilities to break into software-as-a-service cloud ecosystems. Once inside, they accessed application registrations and service principals to impersonate legitimate software, enabling them to move laterally and persist across downstream tenants. In at least one case, attackers persisted by creating backdoor accounts and escalating privileges within downstream environments, ultimately gaining access to emails...