&w=3840&q=100)
Vulnerability exploited on MS SharePoint servers: All you need to know
The company issued an alert to customers Saturday saying it was aware of the zero-day exploit being used to conduct attacks and that it was working to patch the issue. Microsoft updated its guidance Sunday with instructions to fix the problem for SharePoint Server 2019 and SharePoint Server Subscription Edition.
Engineers were still working on a fix for the older SharePoint Server 2016 software.
Anybody who's got a hosted SharePoint server has got a problem, said Adam Meyers, senior vice president with CrowdStrike, a cybersecurity firm. It's a significant vulnerability.
Companies and government agencies around the world use SharePoint for internal document management, data organization and collaboration.
What is a zero-day exploit?
A zero-day exploit is a cyberattack that takes advantage of a previously unknown security vulnerability. "Zero-day" refers to the fact that the security engineers have had zero days to develop a fix for the vulnerability.
According to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the exploit affecting SharePoint is "a variant of the existing vulnerability CVE-2025-49706 and poses a risk to organizations with on-premise SharePoint servers.
Security researchers warn that the exploit, reportedly known as ToolShell, is a serious one and can allow actors to fully access SharePoint file systems, including services connected to SharePoint, such as Teams and OneDrive.
Google's Threat Intelligence Group warned that the vulnerability may allow bad actors to "bypass future patching.
How widespread is the impact?
Eye Security said in its blog post that it scanned over 8,000 SharePoint servers worldwide and discovered that at least dozens of systems were compromised. The cybersecurity company said the attacks likely began on July 18.
Microsoft said the vulnerability affects only on-site SharePoint servers used within businesses or organizations, and does not affect Microsoft's cloud-based SharePoint Online service.
But Michael Sikorski, CTO and Head of Threat Intelligence for Unit 42 at Palo Alto Networks, warns that the exploit still leaves many potentially exposed to bad actors.
While cloud environments remain unaffected, on-prem SharePoint deployments particularly within government, schools, health care including hospitals, and large enterprise companies are at immediate risk."
What do you do now?
The vulnerability targets SharePoint server software so customers of that product will want to immediately follow Microsoft's guidance to patch their on-site systems.
Although the scope of the attack is still being assessed, CISA warned that the impact could be widespread and recommended that any servers impacted by the exploit should be disconnected from the internet until they are patched.
We are urging organisations who are running on-prem SharePoint to take action immediately and apply all relevant patches now and as they become available, rotate all cryptographic material, and engage professional incident response. An immediate, band-aid fix would be to unplug your Microsoft SharePoint from the internet until a patch is available, Sikorski advises.
(Only the headline and picture of this report may have been reworked by the Business Standard staff; the rest of the content is auto-generated from a syndicated feed.)
Hashtags
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Time of India
an hour ago
- Time of India
Microsoft warns of ransomware surge in SharePoint server attacks linked to Chinese hackers
Microsoft Sharepoint zero-day vulnerability Microsoft has issued a warring to organisations that are using on-premises SharePoint servers. The tech giant has confirmed that the hackers are exploiting vulnerabilities in its on on-premises SharePoint servers to deploy ransomware. The Microsoft Threat Intelligence team has identified a specific actor, designated Storm-2603 , as being responsible for these new ransomware campaigns. Earlier, the exploration of SharePoint vulnerabilities led of data exfiltration , but the latest observations suggest motivated financial attacks leveraging the Warlock ransomware. Hackers are using the Warlock ransomware to paralyze networks and demand cryptocurrency payments. How the attack works In an updated blog post Microsoft explains that the attack starts with the exploitation of an internet-facing on-premises SharePoint server. This initial breach grants Storm-2603 access to the environment, often facilitated by a payload named Once the hacker gains access they then move ahead and deploy ransomware. Microsoft has confirmed that SharePoint Online is not affected, but on-premises versions—including SharePoint 2016, 2019, and Subscription Edition—remain vulnerable if not patched. Three Chinese state-sponsored groups behind global attack Microsoft identified three China-linked groups—Linen Typhoon, Violet Typhoon, and Storm-2603—as exploiting critical vulnerabilities in SharePoint servers that rendered customers running the software on their own networks vulnerable to attack. The breaches affected organizations across multiple sectors, including government agencies, energy companies, consulting firms, and universities spanning from the US to Europe and the Middle East. No sensitive or classified information was reportedly compromised in the National Nuclear Security Administration breach, according to sources familiar with the matter. The semiautonomous Energy Department arm responsible for producing and dismantling nuclear weapons was targeted alongside other federal agencies including the US Education Department. What organisation should do Microsoft has also shared some guidelines for users to protect their on-premises SharePoint Server environment. The company has asked the users to: - Enable Antimalware Scan Interface (AMSI) integration and deploy Defender AV on all SharePoint servers - If AMSI cannot be enabled, Microsoft recommends disconnecting servers from the internet - Use Defender for Endpoint to detect post-exploit activity and monitor for suspicious file creation like
Indian Express
an hour ago
- Indian Express
Microsoft says some SharePoint server hackers now use ransomware
A cyber-espionage campaign centered on vulnerable versions of Microsoft's server software now involves the deployment of ransomware, Microsoft said in a late Wednesday blog post. In the post, citing 'expanded analysis and threat intelligence,' Microsoft said a group it dubs 'Storm-2603' is using the vulnerability to seed the ransomware, which typically works by paralyzing victims' networks until a digital currency payment is made. The disclosure marks a potential escalation in the campaign, which has already hit at least 400 victims, according to Netherlands-based cybersecurity firm Eye Security. Unlike typical state-backed hacker campaigns, which are aimed at stealing data, ransomware can cause widespread disruption depending on where it lands. The figure of 400 victims represents a sharp rise from the 100 organisations cataloged over the weekend. Eye Security says the figure is likely an undercount. 'There are many more, because not all attack vectors have left artifacts that we could scan for,' said Vaisha Bernard, the chief hacker for Eye Security, which was among the first organisations to flag the breaches. The details of most of the victim organisations have not yet been fully disclosed, but on Wednesday a representative for the National Institutes of Health confirmed that one of the organisation's servers had been compromised. 'Additional servers were isolated as a precaution,' he said. The news of the compromise was first reported by the Washington Post. The spy campaign kicked off after Microsoft failed to fully patch a security hole in its SharePoint server software, kicking off a scramble to fix the vulnerability when it was discovered. Microsoft and its tech rival, Google owner Alphabet, have both said Chinese hackers are among those taking advantage of the flaw. Beijing has denied the claim.
Time of India
an hour ago
- Time of India
Microsoft says some SharePoint server hackers now use ransomware
Synopsis Microsoft revealed that hackers are exploiting a SharePoint server vulnerability to deploy ransomware, escalating a cyber-espionage campaign linked to group 'Storm-2603.' At least 400 victims are affected, including the US National Institutes of Health. The flaw, initially unpatched, is being exploited by attackers, possibly including Chinese state-backed hackers, despite Beijing's denial.
