Microsoft is investigating a possible leak from its cybersecurity early alert system, the Microsoft Active Protections Program (MAPP), which may have enabled Chinese hackers to exploit SharePoint vulnerabilities.

The breaches reportedly affected over 400 entities worldwide, including US government agencies like the National Nuclear Security Administration.

Microsoft has linked the attacks to Chinese state-sponsored groups, such as Linen Typhoon, Violet Typhoon, and Storm-2603.

The Chinese Embassy in Washington denied the allegations.

The SharePoint flaws were first demonstrated at a cybersecurity conference in May, and attackers exploited them on July 7, just before Microsoft released a patch.

Experts believe a leak from MAPP could explain how the attackers gained knowledge of the vulnerabilities.

MAPP shares early patch information with trusted vendors under NDAs, sometimes up to five days in advance.

Recent Microsoft developments