this exploit affected "tens of thousands" of sharepoint installations, and they guess some of it was chinese because "ttp's aligned" with other attacks (which aligned with ... what?). that's a pretty weak assessment. however ...
It's all they will share with the general public. After Chinese companies broke their trust, and that's the core accusation here, they are not exactly eager to reveal how they caught them. We, the public, can't really know what happens, we will not be presented with hard facts or evidence, but this doesn't mean it doesn't exist. It's up to anyone here to trust either the US accusations or the inevitable Chinese denials.
either way you can easily see that this reaction isn't designed at all to fix a problem, but to cover up incompetence. that's why we can't have nice things.
Here I agree with you. 60 days to fix such a glaring bug is ridiculous and the main reasons, why exploiters could run wild with this bug. If it took exploiters days to go medieval on Microsoft Sharepoint instances world wide, then it can't take months to fix the actual bug.
but imo it wasn't. if you are a state actor exploiting such confidential access you would not compromise it so blatantly just to snoop around some random sharepoint instances, that makes no sense.
Many companies pathetically trust their corporate crown jewels on these awful Sharepoint servers, so "snoop around some random sharepoint servers" is a wild understatement. Yes, you can put some blame on these companies, too, but if the accusation stands, that Chinese companies shared the exploit details with Chinese state security services, then Microsoft's stance is at least understandable. And yes, Microsoft should also finally get their act together 30 years after embracing the internet.