China Accuses US of Cyberattacks Using Microsoft Email Server Flaws

Beijing | August 1, 2025 — Tensions between China and the United States have escalated once again as Beijing formally accused Washington of launching cyberattacks on Chinese military-linked firms by exploiting flaws in Microsoft’s email server software.

According to a statement released by the Cyber Security Association of China, US-based actors were behind two major cyber intrusions targeting companies in China’s defense sector. The association claimed the attacks involved the exploitation of vulnerabilities in Microsoft Exchange, allowing attackers to take control of sensitive servers for nearly a year.

Although the Chinese government did not disclose the names of the companies allegedly targeted, it emphasized that the scale and duration of the attacks posed a direct threat to national security. The Cyber Security Association, while relatively unknown globally, is backed by the Cyberspace Administration of China, the country’s top internet regulator.

This development follows Microsoft’s recent admission that state-sponsored Chinese hacking groups had previously used flaws in their SharePoint software to compromise systems. Earlier attacks on Microsoft Exchange in 2021 and 2023 were also attributed to Chinese entities by US authorities.

In a twist of irony, China is now turning the tables, accusing the US of similar cyber conduct. It claims that the US not only exploited Microsoft Exchange flaws but also accessed confidential data from major defense contractors in China.

A cybersecurity firm, Eye Security, reported that nearly 400 global organizations, including government agencies and corporations—mainly in the US, Mauritius, Jordan, South Africa, and the Netherlands—had been affected in a new wave of breaches. The firm warned that the actual number could be significantly higher.

Microsoft, headquartered in Redmond, Washington, has faced sharp criticism in recent years for what the US government called a “cascade of security failures”, especially following the breach that compromised senior US officials’ email accounts in 2023.

As cyber warfare becomes an increasingly contested domain, this latest accusation signals further deterioration in US-China relations, already strained over trade, Taiwan, and technology competition.