Microsoft, SharePoint and Ransomware
Digest more
Storm-2603 exploits SharePoint flaws to deploy Warlock ransomware, affecting 400+ victims. Microsoft urges mitigation.
Microsoft has pointed the finger at three Chinese nation-state actors for exploiting the SharePoint vulnerabilities, accusing one group of carrying out ransomware attacks. Here's what we know about the security flaws and how to guard against future attacks.
The name was coined by Dinh Ho Anh, a researcher from Khoa of Viettel Cyber Security, who developed the exploit. The researcher said he picked the name because it exploited ToolPane.aspx, a component for assembling the side panel view in the SharePoint user interface.
Microsoft has observed two named Chinese nation-state actors, Linen Typhoon and Violet Typhoon, exploiting vulnerabilities targeting internet-facing SharePoint servers. In addition, we have observed another China-based threat actor,
Microsoft (MSFT) is trying to determine if a leak from its early alert system for cybersecurity companies created a window for Chinese hackers to attack its SharePoint service, according to Bloomberg.