Nuclear Access Through a Microsoft Hole

Nuclear Access Through a Microsoft Hole

The agency that manages America’s nuclear weapons got breached. Not with missiles. Not with drones. With Microsoft SharePoint.

Around July 7, a Chinese state-backed group slipped through a vulnerability Microsoft already knew about. A patch had been released. It failed. The attackers bypassed it almost instantly and moved in.

The exploit chain, known as ToolShell, let them spoof SharePoint’s login system and run code without credentials. They didn’t need a password. They didn’t need access. They just needed someone to keep ignoring an update. They dropped web shells. Stole cryptographic keys. Forged tokens. Then disappeared behind legit-looking traffic.

This wasn’t a test run. It hit the Department of Energy. It hit Fermilab. It hit the National Institutes of Health. The Florida Department of Revenue. The Rhode Island legislature. And it hit the National Nuclear Security Administration. That’s the group overseeing warheads and weapons-grade material.

Government officials say no classified information was taken. But they also admitted the breach spanned multiple systems. The line between internal and sensitive gets blurry fast when you’re inside nuclear infrastructure.

Microsoft reissued guidance and patched the holes again. It was already too late. The attackers had been inside for over a week before detection. By then they had already spread laterally, dumped credentials, and grabbed whatever they came for.

This wasn’t ransomware. No demands. No warnings. No digital graffiti. Just espionage, quiet and surgical. They used common admin tools to avoid detection. They leveraged gaps in basic IT hygiene. And they targeted SharePoint servers that should have never been publicly exposed.

The same Chinese hacking units have been tied to similar operations for years. They focus on intelligence. On trade secrets. On long-term access. Not destruction. Not chaos. Just persistent visibility inside the world’s most powerful networks. And it worked. Again.

This wasn’t about SharePoint. It was about how long critical infrastructure has relied on brittle systems that no one properly watches. The breach was a result of apathy. Bureaucracy. False confidence in a vendor that missed its own fix.

The vault stayed closed. But the walls around it? Wide open.