Google's top security executive links Microsoft SharePoint hack to China, says: We assess that

Time of India

4 days ago

Microsoft issued an alert about "active attacks" on server software used by government agencies and businesses late last week. In an alert issued on Saturday, July 19, Microsoft said that the vulnerabilities apply to SharePoint servers used within organizations. The com[any recommended security updates that customers should apply immediately. It added that if customers cannot enable recommended malware protection, they should disconnect their servers from the internet until a security update is available. The attacks are reported to have allowed hackers to extract cryptographic keys from servers run by Microsoft clients. Those keys, in turn, reportedly would let them install anything, including back doors that they could use to return.
Now new reports suggest a Chinese link to the attacks. According to a top
Google security executive
, a
China-backed hacking group
is behind some of the "active attacks" on Microsoft SharePoint software. 'We assess that at least one of the actors responsible for this early exploitation is a China-nexus threat actor,' said
Charles Carmakal
, chief technology officer of Google's
Mandiant Consulting
. However, Carmakal clarified that Mandiant has observed "multiple actors" actively targeting the SharePoint vulnerability. 'It's critical to understand that multiple actors are now actively exploiting this vulnerability,' he said in the statement. 'We fully anticipate that this trend will continue, as various other threat actors, driven by diverse motivations, will leverage this exploit as well.'
Google said in an earlier emailed statement that it has also observed hackers using this vulnerability to "install webshells and exfiltrate cryptographic secrets from victims servers."
IP addresses inside China detected in Microsoft SharePoint hack
by Taboola
by Taboola
Sponsored Links
Sponsored Links
Promoted Links
Promoted Links
You May Like
American Investor Warren Buffett Recommends: 5 Books For Turning Your Life Around
Blinkist: Warren Buffett's Reading List
Undo
Another researcher, who spoke to Washington Post on the condition of anonymity, said that federal investigators have evidence of US-based servers linked to compromised SharePoint systems connecting to internet protocol addresses inside China on Friday and Saturday.
According to the WAPO report, Piet Kerkhofs, CTO and co-founder of Europe-based Eye Security, highlighted the striking similarities between the recent SharePoint breaches and previous compromises attributed to China-based hacking groups. He further pointed to the exploitation of a vulnerability in Citrix's NetScaler virtual desktop earlier this month, which security researchers observed being leveraged by Chinese actors. He noted the alarming speed with which these freshly discovered vulnerabilities are transformed into weaponized exploits, often within "hours to days."
This rapid weaponization mirrors the global compromise of Microsoft Exchange email servers in early 2021, a significant incident involving hackers sponsored by the Chinese government. That widespread exploitation of core Microsoft software has been attributed to a group Microsoft tracks as
Silk Typhoon
.
Silk Typhoon, linked to China's Ministry of State Security, is considered one of the most technically advanced hacking groups globally. The group has reportedly intensified its attacks on sensitive U.S. targets over the past year, having previously breached multiple U.S. federal agencies. More recently, The Post reported that the Silk Typhoon has also successfully infiltrated several ministries across Europe.
AI Masterclass for Students. Upskill Young Ones Today!– Join Now