For more financial news, go to the News24 Business front page.
Microsoft accused Chinese state-sponsored hackers of using flaws in its SharePoint document management software in a hacking campaign that has targeted businesses and government agencies around the world.
In a blog post on Tuesday, the tech giant identified two groups supported by the Chinese government, Linen Typhoon and Violet Typhoon, as leveraging flaws in SharePoint software used by customers who managed it on their own networks, as opposed to in the cloud. Another hacking group based in China, which Microsoft calls Storm-2603, also exploited the SharePoint vulnerabilities, according to the blog.
“Investigations into other actors also using these exploits is still ongoing,” Microsoft said. “With the rapid adoption of these exploits, Microsoft assesses with high confidence that threat actors will continue to integrate them into their attacks.”
In a statement, the Chinese Embassy said China firmly opposes all forms of cyberattacks and cybercrime.
“At the same time, we also firmly oppose smearing others without solid evidence,” said the statement.
“We hope that relevant parties will adopt a professional and responsible attitude when characterising cyber incidents, basing their conclusions on sufficient evidence rather than unfounded speculation and accusations,” said the statement.
Other cybersecurity researchers have said multiple hacking groups have been making use of the flaws in the popular Microsoft software, and some also indicated that Chinese attackers were likely among them.
Hackers have already used the flaw to break into the systems of national governments in Europe and the Middle East, according to a person familiar with the matter. In the US, they’ve accessed government systems, including ones belonging to the Education Department, Florida’s Department of Revenue and the Rhode Island General Assembly, said the person, who asked not to be identified discussing sensitive information.
The types of organisations targeted, the techniques and other initial evidence is consistent with Chinese state-sponsored espionage, said Eugenio Benincasa, a researcher at the Swiss university ETH Zurich who specialises in analysing Chinese attacks.
The security company Eye Security has detected compromises on more than 100 servers representing 60 victims, including organisations in the energy sector, consulting firms and universities. Victims were also located in Saudi Arabia, Vietnam, Oman and the United Arab Emirates, according to the company.
Multiple different hackers are launching attacks through the Microsoft vulnerabilities, according to representatives of two cybersecurity firms, CrowdStrike Holdings and Google’s Mandiant Consulting.
Attackers have exploited the flaws in SharePoint since at least July 7 in attempted hacks against two “high value targets,” said Adam Meyers, senior vice president at CrowdStrike. The early exploitation resembled government-sponsored activity, and then spread more widely to include hacking that “looks like China,” Meyers said. CrowdStrike’s investigation into the campaign is ongoing, he said.
Microsoft has released patches for the vulnerabilities in servers of the SharePoint document management software. The company said it was still working to roll out other fixes after warnings that hackers were targeting SharePoint clients, using the flaw to enter file systems and execute code.
Representatives of the Department of Education and Rhode Island legislature didn’t respond to calls and emails seeking comment Monday. A Florida Department of Revenue spokesperson, Bethany Wester Cutillo, said in an email that the SharePoint weaknesses are being investigated “at multiple levels of government” but that the state agency “does not comment publicly on the software we use for operations.”
The hackers also breached the systems of a US-based health-care provider and targeted a public university in Southeast Asia, according to a report from a cybersecurity firm reviewed by Bloomberg News. The report doesn’t identify either entity by name, but says the hackers have attempted to breach SharePoint servers in countries including Brazil, Canada, Indonesia, Spain, South Africa, Switzerland, the UK and the US. The firm asked not to be named because of the sensitivity of the information.
In some systems they’ve broken into, the hackers have stolen sign-in credentials, including usernames, passwords, hash codes and tokens, according to a person familiar with the matter, who also spoke on condition that they not be identified discussing the sensitive information.
“This is a high-severity, high-urgency threat,” said Michael Sikorski, chief technology officer and head of threat intelligence for Unit 42 at Palo Alto Networks Inc.
“What makes this especially concerning is SharePoint’s deep integration with Microsoft’s platform, including their services like Office, Teams, OneDrive and Outlook, which has all the information valuable to an attacker,” he said. “A compromise doesn’t stay contained — it opens the door to the entire network.”
Tens of thousands — if not hundreds of thousands — of businesses and institutions worldwide use SharePoint in some fashion to store and collaborate on documents. Microsoft said that attackers are specifically targeting clients running SharePoint servers from their own on-premise networks, as opposed to being hosted and managed by the tech firm. That could limit the impact to a subsection of customers.
“It’s a dream for ransomware operators,” said Silas Cutler, a researcher at Michigan-based cybersecurity firm Censys. He estimated that more than 10 000 companies with SharePoint servers were at risk. The US had the largest number of such firms, followed by the Netherlands, the UK and Canada, he said.
The breaches have drawn new scrutiny to Microsoft’s efforts to shore up its cybersecurity after a series of high-profile failures. The firm has hired executives from places like the US government and holds weekly meetings with senior executives to make its software more resilient. The company’s tech has been subject to several widespread and damaging hacks in recent years, and a 2024 US government report described the company’s security culture as in need of urgent reforms.
The Centre for Internet Security, which operates a cybersecurity information sharing system for state and local governments in the US, found more than 1 100 servers that are at risk from the SharePoint vulnerabilities, said Randy Rose, the organisation’s vice president of security operations and intelligence. Rose said more than 100 were likely hacked.
Eye Security said the flaws allow hackers to access SharePoint servers and steal keys that can let them impersonate users or services even after the server is patched. It said hackers can maintain access through backdoors or modified components that can survive updates and reboots of systems.
The SharePoint vulnerabilities, known as “ToolShell,” were first identified in May by researchers at a Berlin cybersecurity conference. In early July, Microsoft issued patches to fix the security holes, but hackers found another way in.
“There were ways around the patches,” which enabled hackers to break into SharePoint servers by tapping into similar vulnerabilities, said Vaisha Bernard, Eye Security’s chief hacker and co-owner. “That allowed these attacks to happen.” The intrusions, he said, were not targeted and instead were aimed at compromising as many victims as possible.
He declined to identify the identity of organisations that had been targeted, but said they included government agencies and private companies, including “bigger multinationals.” The victims were located in countries in North and South America, the EU, South Africa, and Australia, he added.
3989
