Researchers at Microsoft are warning that Chinese espionage group Silk Typhoon is now targeting common IT solutions like remote management tools and cloud applications to gain initial access. While they haven’t been observed directly targeting Microsoft cloud services, they do exploit unpatched applications that allow them to elevate their access in targeted organizations and conduct further malicious activities.
Microsoft has posted a report on this which you can read here:
https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/
Jim Routh, Chief Trust Officer at cybersecurity company Saviynt, commented:
“The identification of this threat actor, Silk Typhoon, and its tactics helps us understand the implications for enterprise protection. The key takeaway for an enterprise is to shrink the attack surface over time by moving to passwordless authentication where it is feasible. The second step is to limit the storage of credentials to specific data stores that have additive controls in place (PAM, continuous validation). The third is to seek network/endpoint capabilities that identify patterns to detect token usage and exploitation.”
This is yet another example of a threat actor shifting tactics to achieve their goals. That means that those who defend organizations from threat actors have to shift their tactics to stop threat actors like these from succeeding.
UPDATE: Ensar Seker, Chief Security Officer at SOCRadar, commented:
“Microsoft’s latest disclosure about Silk Typhoon signals a significant shift in cyber threat tactics. Instead of relying on direct exploits, they’re now targeting common IT solutions like remote management tools and cloud applications. This move aligns with a broader trend where adversaries exploit trusted third-party applications and supply chains to gain access to organizations.”
“This method allows them to infiltrate multiple targets simultaneously by exploiting stolen API keys, credentials, and vulnerabilities in commonly used applications.”
“While Microsoft states that Silk Typhoon hasn’t directly targeted its cloud services, the group is leveraging unpatched applications to escalate privileges and move laterally within networks. This highlights the ongoing challenge of securing cloud environments, where stolen credentials can grant adversaries persistent access.”
“It is very clear that the attack scope extends beyond IT service providers, affecting healthcare, legal, higher education, government, defense, and energy sectors. This suggests espionage and intelligence gathering remain the primary objectives, rather than immediate financial gain.”
“Third party as an attack vector is reminiscent of high-profile supply chain breaches like SolarWinds and MOVEit. Threat actors recognize that exploiting a single vendor can open doors to a wide range of targets, making IT supply chains one of the biggest cybersecurity weak points.”
“Actually, we shared our analysis with our customers just after the Snowflake case by stating ‘threat actors will continue targeting third-party SaaS, IaaS, and PaaS providers, abusing API integrations and identity federation mechanisms to move undetected across cloud environments. We are expecting more attacks to platforms like Snowflake in the near future just because they can exploit many companies instead of just one.'”
“This development is yet another wake-up call that nation-state cyber operations are becoming more refined, leveraging trusted IT solutions to remain stealthy and persistent. Organizations must move beyond traditional perimeter defenses and adopt a proactive security posture to counter this evolving threat landscape.”
PKI Solutions Announces First and Only Vendor-Agnostic Solution for HSMs
Posted in Commentary with tags PKI Solutions on March 6, 2025 by itnerdPKI Solutions is excited to announce a significant advancement in cryptographic security management: PKI Spotlight’s Multi-HSM Monitoring, the industry’s first, and ONLY, vendor-agnostic solution for Hardware Security Modules (HSMs). For the first time, organizations can gain unified, real-time visibility into both nCipher (Entrust) and Luna (Thales) HSMs, including on-premises and cloud-based deployments (Luna DPoD and nCipher HSM as a Service).
In an era where enterprises operate with increasingly complex and diverse cryptographic infrastructures, PKI Spotlight addresses a critical need—ensuring seamless monitoring, availability, and compliance for HSMs from multiple vendors. Previously, organizations had to rely on disparate, proprietary monitoring tools, resulting in operational silos and limited visibility. Now, with PKI Spotlight’s latest innovation, security teams can monitor HSM availability, configurations, and usage through a single, intuitive interface without needing to provide credentials for your HSMs.
Key Benefits of PKI Spotlight’s Multi-HSM Support:
Gartner recognizes PKI Spotlight as the only PKI posture management solution on the market. It continues to lead the way in enterprise security innovation. While some HSM vendors offer proprietary monitoring tools, PKI Spotlight is the only commercial solution to bridge the gap between monitoring multiple HSM vendors, delivering unparalleled visibility and control.
Organizations looking to enhance their HSM strategy can experience the power of PKI Spotlight firsthand. Request a demo today and discover how real-time monitoring and actionable insights can transform your cryptographic security operations.
Leave a comment »