FOREIGN HACKERS BREACHED A US NUCLEAR WEAPONS PLANT VIA SHAREPOINT FLAWS

Summary from the TLDR InfoSec newsletter

Foreign threat actors breached the Kansas City National Security Campus, which produces 80% of non-nuclear components for US nuclear weapons, by exploiting unpatched Microsoft SharePoint vulnerabilities CVE-2025-53770 (spoofing) and CVE-2025-49704 (RCE) in July, with attribution disputed between Chinese nation-state groups (Linen Typhoon, Violet Typhoon, and Storm-2603) and Russian cybercriminals. While the breach targeted IT systems rather than air-gapped OT/manufacturing environments, experts warn that even unclassified technical data such as precision requirements, tolerances, and supply chain details could provide adversaries with strategic intelligence about US weapons capabilities and manufacturing processes. Security teams should prioritize patching SharePoint on-premises servers, implement a comprehensive zero-trust architecture across both IT and OT environments as outlined in DoD's emerging OT fan chart framework, establish robust IT/OT segmentation to prevent lateral movement, and recognize that nation-state actors may acquire zero-day knowledge through MAPP program misuse or underground exchanges before patches are available.