U.S. Department of the Treasury Vendor Cyber Rating & Cyber Score

Incident : cyberespionage

US-526082425

Exposure Impact

Title: Murky Panda (Silk Typhoon) Exploits Trusted Cloud Relationships for Cyberespionage

Description: A Chinese state-sponsored hacking group known as Murky Panda (Silk Typhoon) exploits trusted relationships in cloud environments to gain initial access to the networks and data of downstream customers. The group targets government, technology, academic, legal, and professional services organizations in North America, leveraging zero-day vulnerabilities, compromised cloud service providers, and custom malware to maintain stealthy access for espionage purposes.

Date Publicly Disclosed: 2024-03

Type: cyberespionage

Attack Vector: exploitation of trusted cloud relationships (SaaS providers, Microsoft CSPs)zero-day vulnerabilities (e.g., Citrix NetScaler CVE-2023-3519, Ivanti Pulse Connect CVE-2025-0282)ProxyLogon (Microsoft Exchange)compromised SOHO devices as proxiesweb shells (Neo-reGeorg, China Chopper)custom Linux RAT (CloudedHope)

Vulnerability Exploited: CVE-2023-3519 (Citrix NetScaler)ProxyLogon (Microsoft Exchange)CVE-2025-0282 (Ivanti Pulse Connect VPN)zero-day vulnerabilities in SaaS provider cloud environmentsEntra ID application registration secretsDelegated Administrative Privileges (DAP) in Microsoft cloud solutions

Threat Actor: Murky PandaSilk Typhoon (Microsoft)Hafnium

Motivation: cyberespionage (targeting government, technology, legal, and professional services for sensitive data)

Incident : cyberespionage US-526082425

Entity Name: U.S. Treasury's Office of Foreign Assets Control (OFAC)

Entity Type: government agency

Industry: financial regulation

Location: United States

Incident : cyberespionage US-526082425

Entity Name: Committee on Foreign Investment in the United States (CFIUS)

Entity Type: government committee

Industry: national security

Location: United States

Incident : cyberespionage US-526082425

Entity Name: Unnamed SaaS provider (compromised via zero-day)

Entity Type: cloud service provider

Industry: technology

Customers Affected: downstream customers (number unspecified)

Incident : cyberespionage US-526082425

Entity Name: Unnamed Microsoft Cloud Solution Provider (CSP)

Entity Type: managed service provider

Industry: technology

Customers Affected: multiple tenants (Global Administrator access obtained)

Incident : cyberespionage US-526082425

Entity Name: Government, technology, academic, legal, and professional services organizations

Entity Type: government agencies, private sector

Industry: public sector, technology, education, legal, professional services

Location: primarily North America

Incident : cyberespionage US-526082425

Third Party Assistance: Crowdstrike (Investigation/Reporting).

Enhanced Monitoring: recommended: monitor Entra ID service principal sign-ins, enforce MFA for cloud accounts, patch cloud infrastructure

Incident : cyberespionage US-526082425

Type of Data Compromised: Emails, Sensitive organizational data, Application data

Sensitivity of Data: high (government, legal, and professional services data)

Incident : cyberespionage US-526082425

Data Exfiltration: True

Incident : cyberespionage US-526082425

Lessons Learned: Trusted cloud relationships (e.g., SaaS providers, CSPs with DAP) are high-value targets for APT groups., Zero-day exploits in cloud environments enable stealthy lateral movement to downstream customers., Monitoring for unusual Entra ID service principal activity is critical for detecting abuse of trusted relationships., Compromised SOHO devices can be repurposed as proxies to evade geographic-based detection., Custom malware (e.g., CloudedHope RAT) and open-source tools (e.g., Neo-reGeorg) are used for persistence.

Incident : cyberespionage US-526082425

Recommendations: Monitor Entra ID logs for anomalous service principal sign-ins., Enforce multi-factor authentication (MFA) for all cloud provider accounts, especially those with administrative privileges., Promptly patch cloud-facing infrastructure, including zero-day vulnerabilities., Restrict delegated administrative privileges (DAP) and review Admin Agent group memberships., Segment cloud environments to limit lateral movement via trusted relationships., Deploy behavioral detection for web shells (e.g., Neo-reGeorg, China Chopper) and custom malware., Audit and rotate application registration secrets in Entra ID., Monitor for traffic originating from compromised SOHO devices.Monitor Entra ID logs for anomalous service principal sign-ins., Enforce multi-factor authentication (MFA) for all cloud provider accounts, especially those with administrative privileges., Promptly patch cloud-facing infrastructure, including zero-day vulnerabilities., Restrict delegated administrative privileges (DAP) and review Admin Agent group memberships., Segment cloud environments to limit lateral movement via trusted relationships., Deploy behavioral detection for web shells (e.g., Neo-reGeorg, China Chopper) and custom malware., Audit and rotate application registration secrets in Entra ID., Monitor for traffic originating from compromised SOHO devices.Monitor Entra ID logs for anomalous service principal sign-ins., Enforce multi-factor authentication (MFA) for all cloud provider accounts, especially those with administrative privileges., Promptly patch cloud-facing infrastructure, including zero-day vulnerabilities., Restrict delegated administrative privileges (DAP) and review Admin Agent group memberships., Segment cloud environments to limit lateral movement via trusted relationships., Deploy behavioral detection for web shells (e.g., Neo-reGeorg, China Chopper) and custom malware., Audit and rotate application registration secrets in Entra ID., Monitor for traffic originating from compromised SOHO devices.Monitor Entra ID logs for anomalous service principal sign-ins., Enforce multi-factor authentication (MFA) for all cloud provider accounts, especially those with administrative privileges., Promptly patch cloud-facing infrastructure, including zero-day vulnerabilities., Restrict delegated administrative privileges (DAP) and review Admin Agent group memberships., Segment cloud environments to limit lateral movement via trusted relationships., Deploy behavioral detection for web shells (e.g., Neo-reGeorg, China Chopper) and custom malware., Audit and rotate application registration secrets in Entra ID., Monitor for traffic originating from compromised SOHO devices.Monitor Entra ID logs for anomalous service principal sign-ins., Enforce multi-factor authentication (MFA) for all cloud provider accounts, especially those with administrative privileges., Promptly patch cloud-facing infrastructure, including zero-day vulnerabilities., Restrict delegated administrative privileges (DAP) and review Admin Agent group memberships., Segment cloud environments to limit lateral movement via trusted relationships., Deploy behavioral detection for web shells (e.g., Neo-reGeorg, China Chopper) and custom malware., Audit and rotate application registration secrets in Entra ID., Monitor for traffic originating from compromised SOHO devices.Monitor Entra ID logs for anomalous service principal sign-ins., Enforce multi-factor authentication (MFA) for all cloud provider accounts, especially those with administrative privileges., Promptly patch cloud-facing infrastructure, including zero-day vulnerabilities., Restrict delegated administrative privileges (DAP) and review Admin Agent group memberships., Segment cloud environments to limit lateral movement via trusted relationships., Deploy behavioral detection for web shells (e.g., Neo-reGeorg, China Chopper) and custom malware., Audit and rotate application registration secrets in Entra ID., Monitor for traffic originating from compromised SOHO devices.Monitor Entra ID logs for anomalous service principal sign-ins., Enforce multi-factor authentication (MFA) for all cloud provider accounts, especially those with administrative privileges., Promptly patch cloud-facing infrastructure, including zero-day vulnerabilities., Restrict delegated administrative privileges (DAP) and review Admin Agent group memberships., Segment cloud environments to limit lateral movement via trusted relationships., Deploy behavioral detection for web shells (e.g., Neo-reGeorg, China Chopper) and custom malware., Audit and rotate application registration secrets in Entra ID., Monitor for traffic originating from compromised SOHO devices.Monitor Entra ID logs for anomalous service principal sign-ins., Enforce multi-factor authentication (MFA) for all cloud provider accounts, especially those with administrative privileges., Promptly patch cloud-facing infrastructure, including zero-day vulnerabilities., Restrict delegated administrative privileges (DAP) and review Admin Agent group memberships., Segment cloud environments to limit lateral movement via trusted relationships., Deploy behavioral detection for web shells (e.g., Neo-reGeorg, China Chopper) and custom malware., Audit and rotate application registration secrets in Entra ID., Monitor for traffic originating from compromised SOHO devices.

Incident : cyberespionage US-526082425

Source: CrowdStrike Report on Murky Panda/Silk Typhoon

Date Accessed: 2024-03

Incident : cyberespionage US-526082425

Source: Microsoft Threat Intelligence (Silk Typhoon)

Incident : cyberespionage US-526082425

Investigation Status: ongoing (per CrowdStrike and Microsoft reports)

Incident : cyberespionage US-526082425

Customer Advisories: Organizations relying on cloud/SaaS providers advised to review trust models and monitoring practices.

Incident : cyberespionage US-526082425

Entry Point: Compromised Cloud Service Providers (Saas, Microsoft Csps), Zero-Day Vulnerabilities In Cloud Environments, Internet-Exposed Devices (Citrix Netscaler, Ivanti Vpn, Microsoft Exchange), Compromised Soho Devices (As Proxies),

Backdoors Established: ['custom backdoor accounts in customer Entra ID environments', 'Neo-reGeorg/China Chopper web shells', 'CloudedHope RAT']

High Value Targets: Government Agencies (E.G., Ofac, Cfius), Technology And Legal Firms, Academic Institutions, Professional Services With Sensitive Data,

Data Sold on Dark Web: Government Agencies (E.G., Ofac, Cfius), Technology And Legal Firms, Academic Institutions, Professional Services With Sensitive Data,

Incident : cyberespionage US-526082425

Root Causes: Over-Reliance On Trusted Cloud Relationships Without Sufficient Monitoring., Lack Of Visibility Into Delegated Administrative Privileges (Dap) In Cloud Environments., Delayed Patching Of Zero-Day Vulnerabilities In Cloud-Facing Infrastructure., Insufficient Detection For Web Shells And Custom Malware In Compromised Systems.,

Corrective Actions: Implement Stricter Access Controls For Cloud Provider Accounts (E.G., Least Privilege, Mfa)., Enhance Logging And Monitoring For Entra Id And Other Identity Providers., Conduct Regular Audits Of Third-Party Cloud Provider Access And Permissions., Deploy Advanced Threat Detection For Post-Exploitation Tools (E.G., Rats, Web Shells)., Isolate Soho Devices From Corporate Networks To Prevent Proxy Abuse.,