Microsoft knew of SharePoint server exploit but failed to effectively patch it
It remains unclear who is behind the ongoing operation, which targeted around 100 organisations over the weekend. But Alphabet's (GOOGL.O), opens new tab Google, which has visibility into wide swathes of internet traffic, said it tied at least some of the hacks to a "China-nexus threat actor".
The Chinese Embassy in Washington did not respond to a Reuters request for comment. Chinese government-linked operatives are regularly implicated in cyberattacks, but Beijing routinely denies carrying out hacking operations.
Contacted on Tuesday, Microsoft was not immediately able to provide comment on the patch and its effectiveness.
The vulnerability that facilitated the attack was first identified in May at a hacking competition, opens new tab in Berlin organised by cybersecurity firm Trend Micro (4704.T), opens new tab, which offered cash bounties for the discovery of computer bugs in popular software.
It offered a $100,000 prize for "zero day" exploits - so called because they leverage previously undisclosed digital weaknesses - that could be used against SharePoint, Microsoft's flagship document management and collaboration platform.
A researcher working for the cybersecurity arm of Viettel, a telecommunications firm operated by Vietnam's military, identified, opens new tab a SharePoint bug at the event, dubbed it 'ToolShell' and demonstrated a method of exploiting it.
The researcher was awarded $100,000 for the discovery, according to a post, opens new tab on X by Trend Micro's "Zero Day Initiative". A spokesperson for Trend Micro did not immediately respond to Reuters' requests for comment regarding the competition on Tuesday.
Microsoft subsequently said in a July 8 security update that it had identified, opens new tab the bug, listed it as a critical vulnerability, and released patches to fix it.
Around 10 days later, however, cybersecurity firms started to notice an influx of malicious online activity targeting the same software the bug sought to exploit: SharePoint servers.
"Threat actors subsequently developed exploits that appear to bypass these patches," British cybersecurity firm Sophos said in a blog post, opens new tab on Monday.
The pool of potential ToolShell targets remains vast.
According to data from Shodan, a search engine that helps to identify internet-linked equipment, over 8,000 servers online could theoretically have already been compromised by hackers.
The Shadowserver Foundation, which scans the internet for potential digital vulnerabilities, put the number at a little more than 9,000, while cautioning that the figure was a minimum.
Those servers include major industrial firms, banks, auditors, healthcare companies, and several U.S. state-level and international government entities.
Hashtags
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
The Independent
9 minutes ago
- The Independent
Trump promised to back Detroit automakers - his deal with Japan has them shaking in their boots
General Motors, Ford and Stellantis - the big three U.S. automakers - pushed back against the Trump administration after President Donald Trump announced a trade deal with Japan that would lower tariffs on vehicles made overseas and hurt the American car companies. Earlier this week, the president said he had signed the 'largest' trade deal in history with Japan, which would include a 15 percent tariff on imported cars – significantly lower than the 25 percent tariff on other imported vehicles. Trump announced the 25 percent tariff on cars made overseas earlier this year, and many of Detroit's companies manufacture cars in Mexico and Canada, which would make them subject to the 25 percent tariff. Higher tariffs likely mean higher costs for consumers, which could lead people to turn to the cheaper Japan-made models. 'Any deal that charges a lower tariff for Japanese imports with virtually no U.S. content than the tariff imposed on North American built vehicles with high U.S. content is a bad deal for U.S. industry and U.S. auto workers,' Matt Blunt, the head of the American Automotive Policy Council, which represents the big three Detroit auotmakers, said in a statement. Blunt said American Automakers were still reviewing the terms of the agreement. During the campaign, Trump visited Detroit and touted the American car industry, promising to 'revolutionize' it. However, shortly after taking the White House, he quickly imposed tariffs on all cars made overseas. General Motors warned just this week that it expects a $4 to $5 billion impact from Trump's tariffs. Auto Drive America, a group that represents U.S. operations of foreign vehicle makers, praised the Japan deal while also calling for Trump to reach similar agreements with the European Union, South Korea, Canada and Mexico. 'We share President Trump's vision to make the U.S. the worldwide center of automotive production, and our member companies need stability in order to create an environment where we can maintain our competitive edge both in the U.S. and on the global stage,' Auto Drive America said. While the deal with Japan will impose lower tariffs, Trump said it will also open market access to the U.S. U.S. auto manufacturers have long struggled to infiltrate the Japanese market, in part because smaller cars that drive on the left side of the road are in much more demand – the type that the U.S. does not typically make. Kush Desai, a spokesperson for the White House, said, 'No president has taken a greater interest in restoring the American auto industry's dominance than President Trump, and his Administration is working closely with the auto industry to achieve this goal.' 'President Trump's trade agenda has already secured historic market access to Japan and Indonesia for Made in America cars with more America First trade deals to come,' Desai added. 'The Administration's domestic policy agenda – from rapid deregulation to the pro-growth tax cuts of The One Big Beautiful Bill – will further boost our auto industry's competitiveness on the world stage and Make American Automakers Great Again.' Hoping to stimulate U.S. manufacturing, the president imposed lofty automotive tariffs earlier this year. Automakers initially raised concerns with the 25 percent tariff in addition to other levies such as those on steel and aluminum. After, Trump offered U.S. automakers some relief through a complicated discount program. Two of the big three Detroit automakers appear to have suffered setbacks. General Motors said Tuesday its second-quarter earnings plummeted 35 percent, compared to the same quarter last year. It also reported a $1 billion loss in second-quarter profits. Stellantis, which makes Chryslers, Jeeps, and more, said it expects to see nearly $350 million in losses in the first two quarters of the year, in part due to tariffs. Around 60 percent of car parts are imported, even if the car is finally assembled in the U.S. Every single 2025 model car sold in the U.S. had at least 15 percent of its parts from a country outside of North America. Trump has threatened to hike tariffs on the U.S.'s largest trading partners, Mexico and Canada, to 30 and 35 percent, respectively.
The Independent
9 minutes ago
- The Independent
California utility creates fund for victims of January's deadly Eaton Fire near LA
Southern California Edison announced this week that it will create a fund to compensate victims of January's devastating Eaton Fire near Los Angeles. Investigators haven't yet determined a cause for the blaze that killed 19 people and destroyed more than 9,400 homes and other structures in Altadena. The creation of the Wildfire Recovery Compensation Program seems to suggest that the utility is prepared to acknowledge what several lawsuits claim: that its equipmentsparked the conflagration. 'Even though the details of how the Eaton Fire started are still being evaluated, SCE will offer an expedited process to pay and resolve claims fairly and promptly,' Pedro Pizarro, chief executive of Edison International, the utility's parent company, said in a statement Wednesday. 'This allows the community to focus more on recovery instead of lengthy, expensive litigation.' It is not clear how much money the utility will contribute to the fund, but a lawsuit filed by Los Angeles County in March claims that costs and damage estimates were expected to total hundreds of millions of dollars. SCE said the compensation program, which will go into effect this fall, would be open to those who lost homes, rental properties or businesses. It would also cover those who suffered injuries, were harmed by smoke or had family members who were killed. The plan is being created by administrators who helped form similar programs, including the September 11th Victim Compensation Fund of 2001. LA County previously won more than $64 million in a settlement with Southern California Edison over the 2018 Woolsey Fire. Investigators determined SCE's equipment sparked that blaze, and the utility also paid more than $2 billion to settle related insurance claims. Utility equipment has sparked some of the deadliest and most destructive fires in state history in recent years. Investigators are also working to determine the cause of the Palisades Fire, which broke out shortly before the Eaton Fire and killed 12 people and destroyed thousands of structures in Los Angeles.
NBC News
10 minutes ago
- NBC News
Alphabet beats earnings expectations, raises spending forecast
Alphabet reported second-quarter results on Wednesday that beat on revenue and earnings, but the company said it would raise its capital investments by $10 billion in 2025. Here's how the company did, compared with estimates from analysts polled by LSEG: Revenue: $96.43 billion vs. $94 billion expected Earnings per share: $2.31 vs. $2.18 expected Wall Street is also watching several other numbers in the report: YouTube advertising revenue: $9.8 billion vs. $9.56 billion, according to StreetAccount Google Cloud revenue: $13.62 billion vs. $13.11 billion, according to StreetAccount Traffic acquisition costs (TAC): $14.71 billion vs. $14.18 billion, according to StreetAccount The company's overall revenue grew 14% year over year, higher than the 10.9% Wall Street expected, but Alphabet is going to spend more on artificial intelligence in 2025 than it anticipated. In February, the company said it expected to invest $75 billion in capital expenditures in 2025 as it continues to expand on its AI strategy. That was already above the $58.84 billion Wall Street expected at the time. The company increased that figure on Wednesday to $85 billion, saying it was raising it due to 'strong and growing demand for our Cloud products and services.' The company expects to further increase capital expenditures in 2026, Alphabet finance chief Anat Ashkenazi said on an earnings call. The company reported revenue of $13.62 billion for its cloud computing business, which is a 32% increase from a year ago. Last week, OpenAI announced that it expected to use Google's cloud infrastructure for its popular ChatGPT service. Alphabet CEO Sundar Pichai said 'we are very excited to be partnering with them.' Alphabet's net income increased to $28.20 billion, up nearly 20% from the previous year. The company's search and advertising units still showed growth in the second quarter despite AI competition heating up. The company's search unit brought in $54.19 billion during the quarter, and its advertising revenue grew to $71.34 billion — up about 10.4% from $64.61 billion the year prior. YouTube advertising revenue came in at $9.8 billion, higher than Wall Street expected. The company said its 'Other Bets' segment, which includes its self-driving car unit Waymo and life sciences unit Verily, brought in $373 million — up from $365 million a year ago. Other Bets reported a loss of $1.25 billion, up from the $1.13 billion a year ago. AI Overviews, Google's AI search product that summarizes search results, now has upward of two billion monthly users across more than 200 countries and territories, Pichai said during Wednesday's earnings call. That's up from 1.5 billion monthly users last quarter. The Gemini app, which has the company's AI chatbot, now has more than 450 million monthly active users, Pichai said. When asked about large spending on AI talent, Ashkenazi said Alphabet makes 'sure that we invest appropriately to have the best and brightest minds in the industry.' Google made a splash in the AI talent wars, announcing earlier in July that it would bring in Windsurf CEO Varun Mohan and other top researchers at the AI coding startup as part of a $2.4 billion deal that also includes licensing the company's technology. Total operating expenses increased 20% to $26.1 billion, Ashkenazi said on Wednesday. The biggest driver of growth was expenses for legal and other matters due in part to a $1.4 billion charge related to a settlement, she said on Wednesday's earnings call. Texas Attorney General Ken Paxton in May announced a $1.37 billion settlement with Google related to a data privacy rights lawsuit it made against the company in 2022. Ashkenazi said Alphabet's third-quarter revenue 'could see a tailwind' due to several reasons. That includes a negative impact for advertising, which benefited from 'strong spend on U.S. elections' in late 2024, particularly on YouTube, she said.
