Microsoft Limits Cyber Intel Access for Chinese Firms

• Microsoft restricts Chinese companies from receiving early cyber threat data after suspected misuse linked to SharePoint attacks.

Adjusting Access After Security Concerns

Microsoft has reduced the level of access granted to certain Chinese companies within its cybersecurity early warning framework. The move follows a series of coordinated attacks targeting Microsoft’s SharePoint servers, which some experts have attributed to actors linked to Beijing. Although the Chinese government has denied any involvement, the timing of the incidents has raised questions about the integrity of Microsoft’s Active Protections Program (MAPP). This initiative is designed to help global security vendors respond to emerging threats before public disclosure.

Details of the SharePoint vulnerabilities were shared with MAPP participants on June 24, July 3, and July 7. Microsoft reported that exploitation attempts began on July 7, leading some analysts to suspect that a participant may have misused the information. The rapid escalation in attacks suggested that the leak may have originated from within the program itself. In response, Microsoft has taken steps to limit the distribution of sensitive materials to select Chinese firms.

Proof-of-Concept Code Restrictions

Among the restricted resources is “proof of concept” (PoC) code, which simulates the behavior of actual malware. While PoC code is a valuable tool for defenders aiming to patch vulnerabilities quickly, it can also be weaponized by malicious actors. Microsoft acknowledged the dual-use nature of such data and emphasized its commitment to preventing misuse. The company stated that it regularly audits program participants and enforces contractual clauses prohibiting offensive cyber operations.

Microsoft has not provided further details regarding the internal investigation or named the companies affected by the new restrictions. The decision to withhold specifics reflects the sensitive nature of the issue and the potential diplomatic implications. Cybersecurity experts continue to monitor the situation, noting that insider misuse of threat intelligence remains a persistent risk. The incident underscores the challenges of balancing transparency with operational security in global threat-sharing programs.