Microsoft has confirmed three Chinese-based threat groups have been actively exploiting CVE-2025-53770 and CVE-2025-53771, two critical and high-severity vulnerabilities in internet-facing SharePoint servers. The chained exploitation of these two bugs has been dubbed ‘ToolShell’ by the cybersecurity community. In a new blog posted on July 22, Microsoft Threat Intelligence confirmed that these groups include Linen Typhoon and Violet Typhoon, two China-based advanced persistent threat (APT) groups and Storm-2603, another China-based threat actor whose motivations and identity are unclear at this time. Who is Behind Linen Typhoon, Violet Typhoon and Storm-2603 Linen Typhoon (APT27) is a Chinese state-backed actor that has been active since at least 2010. It typically targets foreign…