Microsoft Patch Failed to Fix SharePoint Flaw, Enabling Global Cyber Espionage

A critical vulnerability in Microsoft’s SharePoint server software remained exploitable despite an initial patch, enabling a widespread cyber espionage campaign targeting around 100 organisations globally.

Microsoft confirmed that its first patch, released earlier this month, did not fully resolve the flaw. The company has since issued additional updates to address the issue.

The vulnerability, dubbed "ToolShell," was first discovered in May during a hacking competition in Berlin hosted by cybersecurity firm Trend Micro. A researcher from Viettel, a Vietnamese military-operated telecommunications firm, identified and demonstrated the exploit, earning a USD 100,000 prize.

Microsoft listed the flaw as a critical vulnerability in a July 8 update and released a patch. However, within 10 days, cybersecurity firms observed a surge in malicious activity targeting SharePoint servers.

British cybersecurity firm Sophos reported that threat actors developed exploits that bypassed Microsoft’s initial patch. Microsoft stated in a blog post that Chinese-linked hacking groups, including "Linen Typhoon" and "Violet Typhoon," were exploiting the flaw, along with another China-based group.

Both Microsoft and Google have attributed the first wave of attacks to China-linked hackers. The Chinese embassy in Washington denied involvement, stating that China opposes all forms of cyberattacks and criticised accusations made without solid evidence.

Trend Micro emphasised that vendors participating in its competition are responsible for patching and disclosing vulnerabilities effectively and promptly. The company noted that patch failures have occurred with SharePoint in the past.

According to internet search engine Shodan, more than 8,000 SharePoint servers could be vulnerable. The Shadowserver Foundation estimated over 9,000 potentially affected servers, primarily in the United States and Germany, including those operated by industrial firms, banks, healthcare providers, auditors, and government entities.

Germany’s federal cybersecurity agency, BSI, confirmed that vulnerable SharePoint servers were found within government networks but said none had been compromised.

---

• Microsoft’s initial patch failed to fix a critical SharePoint flaw

• The vulnerability, ToolShell, was discovered in May at a hacking contest

• Chinese-linked hackers are exploiting the flaw in a global cyber campaign

Source: REUTERS