Microsoft has confirmed that multiple China-based threat actors have exploited critical vulnerabilities in its on-premises SharePoint Server software, breaching the defences of hundreds of organisations worldwide in what is shaping up to be one of the most significant cyberattacks of 2025.
In a detailed security blog published by the Microsoft Security Response Centre (MSRC), the company revealed that three advanced threat groups – Storm‑1177, Storm‑0866 and Storm‑2268 – had used two recently patched flaws (CVE‑2025‑23770 and CVE‑2025‑23771) to infiltrate vulnerable SharePoint servers. The campaign began in early July and has impacted sectors ranging from government and education to healthcare and large-scale enterprise.
Authentication spoofed, networks infiltrated
The attackers were able to spoof authentication credentials, allowing them to impersonate authorised users and gain access to SharePoint environments. Once inside, they exfiltrated sensitive data, established backdoors, and in several cases moved laterally through the network undetected.
While Microsoft has not disclosed exact numbers, independent cybersecurity researchers estimate that between 400 and 500 organisations may have been compromised, among the affected are believed to be at least one U.S. federal agency.
“These attacks demonstrate a high level of sophistication,” Microsoft stated, adding that the use of stolen access tokens and forged authentication cookies allowed the threat actors to maintain persistence and evade conventional defences. The activity observed, the company added, appears aligned with espionage and intelligence-gathering objectives.
State-sponsored cyber threats on the rise
The groups identified in the attack—each labelled with “Storm” designations—are associated with China’s state-sponsored cyber operations. Their activities form part of a growing pattern of cyber-enabled espionage targeting critical infrastructure, intellectual property, and strategic data.
This latest incident recalls past state-linked attacks such as the 2021 Microsoft Exchange vulnerabilities and the SolarWinds breach. What distinguishes this campaign is its focus on on-premises SharePoint servers—systems that many organisations continue to run internally despite a broader shift towards cloud infrastructure.
Microsoft issues urgent remediation steps
Microsoft released patches addressing the exploited vulnerabilities on 9 July. In addition to applying these updates immediately, the company is urging organisations to:
- Rotate all potentially compromised authentication keys
- Enable forensic logging and audit tools
- Deploy Microsoft Defender for Identity to detect lateral movement
- Review audit logs for anomalies and unauthorised access
Microsoft also acknowledged the assistance of security partners such as Palo Alto Networks’ Unit 42, who helped identify and track the ongoing campaign.
A wake-up call for legacy infrastructure
The breach has underscored the dangers of outdated infrastructure and the lag in patch adoption across many enterprise environments. Microsoft warned that attackers will continue to exploit unpatched, internet-facing servers if organisations do not modernise their systems or follow robust security practices.
While SharePoint Online (the cloud-based version) remains unaffected, the company emphasised the importance of adopting zero-trust architecture, modern identity safeguards, and cross-cloud governance strategies—especially for hybrid environments.
As the investigation continues, Microsoft’s findings have added urgency to what many security professionals see as a critical moment: an inflection point where failing to patch legacy systems may pose as much risk as facing novel, AI-driven threats.
