Microsoft Claims Chinese Hackers Exploit Critical SharePoint Zero-Day Vulnerability in Large-Scale Cyberattack on Government Agencies, Businesses, and Sensitive Infrastructure

Cyberattacks are on the rise, particularly those orchestrated against major corporations, which often reveal significant security vulnerabilities. Recently, Microsoft has publicly accused state-sponsored attackers from China of exploiting flaws in its SharePoint document management software as part of a widespread cyber-espionage campaign. This operation primarily targets sensitive infrastructures within businesses and government agencies. In response to these allegations, the Chinese Embassy has rejected them as unfounded. However, Microsoft maintains that its clients were specifically targeted, prompting the company to release critical security patches to counteract this threat.

Microsoft’s Accusations: Chinese Hackers Exploit SharePoint Vulnerabilities

Numerous tech firms in the United States have pointed fingers at Chinese hackers for taking advantage of existing weaknesses in software systems. Most recently, Microsoft made its findings public through a blog post, identifying two Chinese government-affiliated groups, Linen Typhoon and Violent Typhoon. They allegedly exploited a security vulnerability found in on-premises SharePoint deployments, rather than the cloud-based alternative. Additionally, another group called Storm-2603 was also implicated in these exploits, which Microsoft indicates are linked to broader ransomware activities.

Microsoft discovered a zero-day vulnerability in the self-hosted versions of SharePoint servers. This flaw allowed attackers to bypass authentication protocols, assume user identities, and manipulate the system to recognize them as legitimate users. Fortunately, Microsoft confirmed that its cloud-hosted SharePoint services remained unaffected. It has been noted that these attacks initiated on July 7, prior to the public’s awareness of the situation.

As the threat landscape continues to evolve, Microsoft cautions users about an increased number of potential threat actors attempting to exploit these vulnerabilities. Google’s Chief Technology Officer has corroborated these claims, suggesting that at least one of the groups involved has ties to China and that various hacking collectives are actively seeking to exploit this security gap. In response to these developments, Microsoft stated:

With the rapid adoption of these exploits, Microsoft assesses with high confidence that threat actors will continue to integrate them into their attacks.

The Chinese Embassy has promptly denied these assertions and labeled them baseless, firmly opposing any form of cybercrime and expressing skepticism regarding unsupported claims. Their statement emphasized:

China firmly opposes all forms of cyberattacks and cybercrime. At the same time, we also firmly oppose smearing others without solid evidence.

While the precise involvement of these Chinese hacking groups remains uncertain, Microsoft has taken proactive measures by releasing emergency patches to mitigate ongoing risks. The company continues to roll out additional security updates aimed at reinforcing its systems against any external threats that seek to capitalize on these vulnerabilities.

Source & Images