Microsoft Tapped China Engineers for SharePoint Support

A new investigation has revealed that Microsoft relied on China-based engineers to provide technical support and bug fixes for SharePoint, the same software that was recently exploited by Chinese state-sponsored hackers in a massive cyberattack affecting hundreds of organisations, including sensitive U.S. government agencies.

Last month, Microsoft announced that Chinese hackers had successfully exploited vulnerabilities in SharePoint to breach the computer systems of numerous companies and government agencies, including the National Nuclear Security Administration and the Department of Homeland Security. According to internal Microsoft work-tracking system screenshots reviewed by ProPublica, China-based employees were recently fixing bugs for SharePoint OnPrem, the on-premises version targeted in last month’s attacks.

When confronted about this arrangement, Microsoft said the China-based team “is supervised by a US-based engineer and subject to all security requirements and manager code review,” and work is already underway to shift this work to another location. The timing of these revelations is concerning given that Microsoft’s analysis showed Chinese hackers began exploiting SharePoint weaknesses as early as 7 July 2025, with a patch issued on 8 July 2025, subsequently bypassed by attackers.

Microsoft announced it had halted its use of China-based engineers to support Defence Department cloud computing systems and was considering implementing the same change for other government cloud customers.