Another hacking group based in China, which Microsoft calls Storm-2603, also exploited them, according to the blog.<\/p>\n\n\n\n
The number of companies and agencies subjected to breaches as a result of these exploits is meanwhile mounting: Hackers have\u00a0used<\/a>\u00a0the SharePoint flaws to break into the US National Nuclear Security Administration, according to a person with knowledge of the matter who wasn\u2019t authorised to speak publicly. <\/p>\n\n\n\n Bloomberg also reported Monday that systems belonging to the US Education Department, Florida\u2019s Department of Revenue and the Island General Assembly were compromised.<\/p>\n\n\n\n While Microsoft has patched its software in recent days, cybersecurity researchers have already detected breaches on more than 100 servers representing 60 victims thus far, including organisations in the energy sector, consulting firms and universities. <\/p>\n\n\n\n Hackers have also exploited the software to break into the systems of national governments from Europe to the Middle East, according to a person familiar with the matter.<\/p>\n\n\n\n The SharePoint flaws have been used in hacks since at least July 7, said Adam Meyers, senior vice president at CrowdStrike Holdings Inc. <\/p>\n\n\n\n Early exploitation resembled government-sponsored activity, and then spread more widely to include hacking that \u201clooks like China,\u201d Meyers said. CrowdStrike\u2019s investigation into the campaign is ongoing, he said.\u00a0<\/p>\n\n\n\n Microsoft said in its blog that its investigations into other threat actors using these exploits \u201cis still ongoing.\u201d <\/p>\n\n\n\n The company said it has \u201chigh confidence\u201d that hackers will \u201ccontinue to integrate them into their attacks.\u201d<\/p>\n\n\n\n In a statement, the Chinese Embassy in Washington said China firmly opposes all forms of cyberattacks and cybercrime.<\/p>\n\n\n\n \u201cAt the same time, we also firmly oppose smearing others without solid evidence,\u201d it said. <\/p>\n\n\n\n \u201cWe hope that relevant parties will adopt a professional and responsible attitude when characterising cyber incidents, basing their conclusions on sufficient evidence rather than unfounded speculation and accusations.\u201d<\/p>\n\n\n\n No sensitive or classified information is known to have been compromised in the attack on the National Nuclear Security Administration, the person with knowledge of the breach said. <\/p>\n\n\n\n The semiautonomous arm of the Energy Department is responsible for producing and dismantling nuclear arms. Other parts of the department were also compromised.<\/p>\n\n\n\n An Energy Department spokesman said by email that the SharePoint exploitation began affecting the agency on July 18, but it was limited by the fact that the department uses Microsoft\u2019s cloud.<\/p>\n\n\n\n Representatives of the US Department of Education and Rhode Island legislature meanwhile didn\u2019t respond to calls and emails seeking comment. <\/p>\n\n\n\n The Florida Department of Revenue said the SharePoint weaknesses were being investigated \u201cat multiple levels of government\u201d but declined further comment.\u00a0<\/p>\n\n\n\n The hackers have also breached the systems of a US-based health-care provider and targeted a public university in Southeast Asia, according to a report from a cybersecurity firm reviewed by Bloomberg News. <\/p>\n\n\n\n The report doesn\u2019t identify either entity by name, but says the hackers have attempted to breach SharePoint servers in countries including Brazil, Canada, Indonesia, Spain, South Africa, Switzerland, the UK and the US. The firm asked not to be named because of the sensitivity of the information.<\/p>\n\n\n\n Hackers have stolen sign-in credentials, including usernames, passwords, hash codes and tokens, from some systems, according to a person familiar with the matter, who asked not to be identified discussing sensitive information.<\/p>\n\n\n\n \u201cThis is a high-severity, high-urgency threat,\u201d said Michael Sikorski, chief technology officer and head of threat intelligence for Unit 42 at Palo Alto Networks Inc<\/a>.<\/p>\n\n\n\n \u201cWhat makes this especially concerning is SharePoint\u2019s deep integration with Microsoft\u2019s platform, including their services like Office, Teams, OneDrive and Outlook, which has all the information valuable to an attacker,\u201d he said.<\/p>\n\n\n\n The cyber firm Eye Security said the flaws allow hackers to access SharePoint servers and steal keys that can let them impersonate users or services even after the server is patched. <\/p>\n\n\n\n It said hackers can maintain access through backdoors or modified components that can survive updates and reboots of systems.<\/p>\n\n\n\n The breaches have drawn new scrutiny to Microsoft\u2019s\u00a0efforts<\/a>\u00a0to shore up its security after a series of high-profile failures. <\/p>\n\n\n\n The firm has hired executives from places like the US government and holds weekly meetings with senior executives to make its software more resilient. <\/p>\n\n\n\n![\"\"](\"https:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2025\/07\/436714962.jpg\")
<\/figure>\n\n\n\n