Redazione RHC : 27 October 2025 11:12
Government hackers breached a nuclear weapons component manufacturing facility in the United States by exploiting vulnerabilities in Microsoft SharePoint. The incident affected the Kansas City National Security Campus (KCNSC) , part of the U.S. Department of Energy’s National Nuclear Security Administration (NNSA) .
According to some sources , the attack occurred in August and involved the exploitation of unpatched bugs tracked under CVE-2025-53770 and CVE-2025-49704, which allow remote code execution on the SharePoint server.
The facility, operated by Honeywell Federal Manufacturing & Technologies, produces most of the non-nuclear mechanical and electronic components for the U.S. nuclear arsenal. It houses departments responsible for metallography, analytical chemistry, environmental testing, and modeling.
Approximately 80 percent of all U.S. nuclear munitions components are produced here, making it one of the most sensitive points in the defense infrastructure.
Microsoft released security updates on July 19, but attackers began exploiting the discovered vulnerabilities by the 18th. The Department of Energy confirmed the attacks but said the damage was limited by migrating most systems to the Microsoft 365 cloud platform . Recovery efforts were carried out with the assistance of NSA specialists, who arrived in early August.
Experts disagree on the origin of the attackers. Microsoft attributes the wave of SharePoint exploits to the Chinese groups Linen Typhoon, Violet Typhoon, and Storm-2603 , which the company claims were preparing to distribute the Warlock malware.
Resecurity, which monitored the campaign, believes Chinese actors are most likely involved, but also considers the possibility that groups from other countries gained access to the exploits through darknet exchanges.
According to experts, the vulnerabilities may have been replicated after being demonstrated at Pwn2Own in Berlin by researchers from Viettel Cyber Security, accelerating the spread of exploits on the darknet.
The initial scans and attacks originated from servers in Taiwan, Vietnam, South Korea, and Hong Kong , a typical geographic location for Chinese APT groups seeking to hide their origins. Resecurity emphasizes that the campaign relied on abusing the Microsoft Active Protections Program (MAPP), which provides partners with early access to vulnerability data. However, after the technical details became public, other attackers began using the exploits.
Although the attack targeted the company’s IT infrastructure, industrial security experts emphasize the risk of a potential penetration into the operational systems (OT) that control robotic assembly lines, programmable logic controllers (PLCs), and SCADA systems responsible for power supply and environmental monitoring. Even with the physical isolation of the production circuit from the corporate network, the risk of a complete disruption of the channel cannot be ruled out.
The incident illustrates how inadequate cybersecurity measures in operational environments pose a threat to strategic resources. While federal agencies are already implementing a “zero trust” architecture for IT infrastructure, a similar system for production networks is still under development. The Department of Defense is developing its own set of controls for OT environments, which is expected to be integrated with the federal standard in the future.
Even if attackers only had access to unclassified data, such information would be extremely valuable. Technical specifications, tolerances, and assembly parameters can shed light on the precision of US weapons, the structure of supply chains, or quality control methods . This allows adversaries to indirectly assess the reliability and technological capabilities of US defense programs.
The Department of Energy later officially confirmed that a SharePoint vulnerability had indeed been exploited against the NNSA, but that the damage was minimal and no classified information was compromised. Nonetheless, the incident highlighted the defense industry’s vulnerability even to attacks that only target corporate systems.
Redazione
