Microsoft has released patches after discovering that a vulnerability in its on-premises SharePoint software, commonly used for enterprise collaboration, was being actively exploited, prompting CISA to issue a security alert urging organizations to apply fixes without delay
Â
Â
Microsoft has attributed a recent wave of cyberattacks targeting its SharePoint platform to Chinese state-affiliated hacking groups. The company identified the actors as Linen Typhoon, Violet Typhoon, and Storm-2603, stating that they began exploiting a vulnerability in the software as early as July 7.
The exploited vulnerability affects on-premises versions of SharePoint, a widely used enterprise collaboration tool within Microsoft’s Office ecosystem. SharePoint allows organizations to manage and share internal files and content across teams, making it a prime target for espionage-driven actors.
In response to the active exploitation, Microsoft released patches addressing the issue across multiple versions of the software. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) also issued an alert on July 20, warning of ongoing threat activity and urging immediate remediation.
Further confirmation came from Mandiant, a leading cybersecurity firm owned by Google. Charles Carmakal, Mandiant’s CTO, stated on LinkedIn that at least one of the groups exploiting the flaw is a known China-nexus threat actor.
Repeated breaches raise alarm
The breach underscores continued cyber risk from state-aligned groups, particularly in the context of strategic software platforms. It also follows heightened scrutiny of Microsoft’s security practices. In 2023, the company faced criticism from U.S. federal agencies over its response to a China-linked breach involving email accounts of American officials.
In a related development, Microsoft recently announced it would no longer involve China-based engineers in supporting U.S. Department of Defense cloud infrastructure projects, following concerns over potential national security risks.
This incident mirrors earlier attacks, such as the 2021 exploitation of Microsoft Exchange Server by the China-linked Hafnium group, which affected thousands of global organizations.
With the current SharePoint vulnerability actively exploited, cybersecurity experts warn of the need for swift patching, better segmentation of sensitive systems, and enhanced vigilance across enterprise IT networks.
