Microsoft has warned that Chinese state-sponsored hackers are among those exploiting flaws in its SharePoint software to break into institutions globally, with the US agency responsible for designing nuclear weapons now among those breached.
In a blog post, the tech giant identified two groups supported by the Chinese government, Linen Typhoon and Violet Typhoon, as leveraging flaws in the document-sharing software that rendered customers who run it on their own networks, as opposed to in the cloud, vulnerable. Another hacking group based in China, which Microsoft calls Storm-2603, also exploited them, according to the blog.
The number of companies and agencies subjected to breaches as a result of these exploits is meanwhile mounting: hackers have used the SharePoint flaws to break into the US National Nuclear Security Administration, according to a person with knowledge of the matter who wasn’t authorised to speak publicly. Systems belonging to the US education department, Florida’s department of revenue and the Island General Assembly were compromised.
While Microsoft has patched its software in recent days, cybersecurity researchers have already detected breaches on more than 100 servers representing 60 victims thus far, including organisations in the energy sector, consulting firms and universities. Hackers have also exploited the software to break into the systems of national governments from Europe to the Middle East, according to a person familiar with the matter.
The SharePoint flaws have been used in hacks since at least 7 July, said Adam Meyers, senior vice president at CrowdStrike Holdings. Early exploitation resembled government-sponsored activity, and then spread more widely to include hacking that “looks like China”, Meyers said. CrowdStrike’s investigation into the campaign is ongoing, he said.
Microsoft said in its blog that its investigations into other threat actors using these exploits “is still ongoing”. The company said it has “high confidence” that hackers will “continue to integrate them into their attacks”.
‘Unfounded speculation’
In a statement, the Chinese embassy in Washington said China firmly opposes all forms of cyberattacks and cybercrime.
“At the same time, we also firmly oppose smearing others without solid evidence,” it said. “We hope that relevant parties will adopt a professional and responsible attitude when characterising cyber incidents, basing their conclusions on sufficient evidence rather than unfounded speculation and accusations.”
No sensitive or classified information is known to have been compromised in the attack on the National Nuclear Security Administration, the person with knowledge of the breach said. The semiautonomous arm of the energy department is responsible for producing and dismantling nuclear arms. Other parts of the department were also compromised.
Read: SharePoint zero-day hits servers, Microsoft issues emergency alert
An energy department spokesman said by email that the SharePoint exploitation began affecting the agency on 18 July, but it was limited by the fact that the department uses Microsoft’s cloud.
Representatives of the US department of education and Rhode Island legislature meanwhile didn’t respond to calls and e-mails seeking comment. The Florida department of revenue said the SharePoint weaknesses were being investigated “at multiple levels of government” but declined further comment.
The hackers have also breached the systems of a US-based health-care provider and targeted a public university in Southeast Asia, according to a report from a cybersecurity firm reviewed by Bloomberg News. The report doesn’t identify either entity by name, but says the hackers have attempted to breach SharePoint servers in countries including Brazil, Canada, Indonesia, Spain, South Africa, Switzerland, the UK and the US. The firm asked not to be named because of the sensitivity of the information.
Hackers have stolen sign-in credentials, including usernames, passwords, hash codes and tokens, from some systems, according to a person familiar with the matter, who asked not to be identified discussing sensitive information.
“This is a high-severity, high-urgency threat,” said Michael Sikorski, chief technology officer and head of threat intelligence for Unit 42 at Palo Alto Networks.
“What makes this especially concerning is SharePoint’s deep integration with Microsoft’s platform, including their services like Office, Teams, OneDrive and Outlook, which has all the information valuable to an attacker,” he said.
The cyber firm Eye Security said the flaws allow hackers to access SharePoint servers and steal keys that can let them impersonate users or services even after the server is patched. It said hackers can maintain access through backdoors or modified components that can survive updates and reboots of systems.
The breaches have drawn new scrutiny to Microsoft’s efforts to shore up its security after a series of high-profile failures. The firm has hired executives from places like the US government and holds weekly meetings with senior executives to make its software more resilient. The company’s tech has been subject to several widespread and damaging hacks in recent years, and a 2024 US government report described the company’s security culture as in need of urgent reforms.
Not targeted
Eye Security has detected compromises on more than 100 servers representing 60 victims, including organisations in the energy sector, consulting firms and universities. Victims were also located in Saudi Arabia, Vietnam, Oman and the United Arab Emirates, according to the company.
In early July, Microsoft issued patches to fix the security holes, but hackers found another way in.
“There were ways around the patches” that enabled hackers to break into SharePoint servers by tapping into similar vulnerabilities, said Vaisha Bernard, Eye Security’s chief hacker and co-owner. “That allowed these attacks to happen.” The intrusions, he said, were not targeted and instead were aimed at compromising as many victims as possible.
Read: Microsoft hosts security summit after CrowdStrike disaster
He declined to identify the identity of organisations that had been targeted, but said they included government agencies and private companies, including “bigger multinationals”. The victims were located in countries in North and South America, the European Union, South Africa and Australia, he said. — Jake Bleiberg, Ari Natter, Ryan Gallagher and Patrick Howell O’Neill, (c) 2025 Bloomberg LP
Get breaking news from TechCentral on WhatsApp. Sign up here.