China-Linked Hackers Exploit Microsoft SharePoint Flaws; U.S. Agencies Among Victims

A large-scale cyberattack involving hackers linked to China has hit organizations around the world. These hackers are targeting a flaw in Microsoft SharePoint, a popular server software used by businesses and government offices. According to a report by Politico, some U.S. federal agencies may be among the victims.

Three Chinese Hacker Groups Involved

Microsoft shared in a blog post that three China-based hacking groups — Violet Typhoon, Linen Typhoon, and Storm-2603 — are responsible for the attacks. One U.S. official said about 100 organizations, including at least two U.S. federal agencies, have likely been affected. Another official with knowledge of the matter confirmed this, speaking on condition of anonymity due to the sensitive situation.

Critical Security Flaws Exploited

The hackers used a serious security flaw in customer-managed Microsoft SharePoint servers to gain access. SharePoint is widely used in workplaces for file sharing and collaboration. This weakness allowed attackers to remotely enter systems run by organizations using self-hosted versions of SharePoint. Microsoft said it believes these hackers will continue to use this method as long as systems remain unpatched. Cloud-based SharePoint users were not affected by this issue.

Since the attack was first noticed on Saturday, cybersecurity experts and federal officials have been working to respond. One U.S. official mentioned that around four to five federal agencies were likely breached, but investigations are still ongoing to determine the full impact.

Microsoft and U.S. Agencies Respond

Microsoft is working with its customers to make sure the necessary updates are applied. The company is also cooperating closely with CISA (Cybersecurity and Infrastructure Security Agency), the U.S. Department of Defense Cyber Command, and other global cybersecurity teams. A CISA spokesperson confirmed that Microsoft has been quick in its response. This attack adds to a list of recent security breaches linked to Chinese hackers. In 2023, Chinese attackers accessed emails belonging to the U.S. ambassador to China and the U.S. Commerce Secretary by using several Microsoft vulnerabilities. Just last week, the Pentagon announced a full review of its cloud services after learning that engineers based in China were offering technical help on Pentagon systems.