This month’s Microsoft security update failed to fully patch a critical vulnerability in SharePoint server software, paving the way for a large-scale global cyber-espionage campaign, according to a timeline reviewed by Reuters.<\/p>\n\n\n\n
On Tuesday, a Microsoft spokesperson confirmed that the initial patch \u2014 intended to fix the vulnerability discovered during a hacking competition in May \u2014 did not work. However, the company has since issued additional patches which it says have resolved the issue.<\/p>\n\n\n\n
It remains unclear who exactly is behind the attack, which affected around 100 organizations over the weekend. The scale of malicious activity is expected to grow, as other hacker groups may join in.<\/p>\n\n\n\n
Microsoft’s blog states that at least two Chinese hacking groups \u2014 Linen Typhoon and Violet Typhoon \u2014 as well as a third, also based in China, are involved in the attacks.<\/p>\n\n\n\n
Microsoft and Google (Alphabet\u2019s division) both stated that Chinese-linked hackers are likely behind the first wave of attacks. China traditionally denies involvement in any cyberattacks.<\/p>\n\n\n\n
In response to Reuters, the Chinese embassy in Washington stated that China opposes all forms of cyberattacks and condemns “groundless accusations.”<\/p>\n\n\n\n
The vulnerability that enabled these attacks was first identified in May during a hacking contest in Berlin, organized by cybersecurity firm Trend Micro. It offered a $100,000 reward for zero-day exploits \u2014 previously unknown flaws \u2014 targeting software such as SharePoint.<\/p>\n\n\n\n
Among the potential targets was the U.S. National Nuclear Security Administration, responsible for the country\u2019s nuclear arsenal. According to Bloomberg, data from this agency was also accessed, though no leak of confidential or classified information has been confirmed.<\/p>\n\n\n\n
A researcher from Viettel, a Vietnamese military-controlled telecom company, discovered the vulnerability during the May event, named it ToolShell, and demonstrated its use. He received $100,000 through Trend Micro\u2019s Zero Day initiative.<\/p>\n\n\n\n
Trend Micro emphasized that software vendors are responsible for timely patching. \u201cPatches sometimes fail. This has happened with SharePoint before,\u201d the company said in a statement.<\/p>\n\n\n\n
In its July 8 security update, Microsoft classified the vulnerability as critical and released patches. However, within 10 days, cybersecurity firms observed a wave of malicious activity targeting the same SharePoint servers.<\/p>\n\n\n\n
British firm Sophos reported Monday that attackers developed exploits capable of bypassing Microsoft\u2019s patches.<\/p>\n\n\n\n
The number of potentially vulnerable ToolShell targets remains very high. According to search engine Shodan, which tracks internet-connected devices, hackers could potentially compromise over 8,000 servers.<\/p>\n\n\n\n
These servers are located in the networks of auditing firms, banks, healthcare providers, industrial companies, U.S. government agencies, and international organizations.<\/p>\n\n\n\n
The Shadowserver Foundation, which scans the internet for vulnerabilities, counted over 9,000 potentially compromised servers, calling it a conservative estimate. Most affected are in the U.S. and Germany.<\/p>\n\n\n\n
Germany\u2019s Federal Office for Information Security (BSI) stated Tuesday that no government SharePoint servers were breached, though some were vulnerable to ToolShell.<\/p>\n","protected":false},"featured_media":5432,"template":"","class_list":["post-5435","nwes","type-nwes","status-publish","has-post-thumbnail","hentry"],"acf":[],"yoast_head":"\n