Microsoft has confirmed that multiple China-based threat actors have exploited critical vulnerabilities in its on-premises SharePoint Server software, breaching the defences of hundreds of organisations worldwide in what is shaping up to be one of the most significant cyberattacks of 2025.<\/p>\n\n\n\n
In a detailed security blog published by the Microsoft Security Response Centre (MSRC), the company revealed that three advanced threat groups – Storm\u20111177<\/strong>, Storm\u20110866<\/strong> and Storm\u20112268<\/strong> – had used two recently patched flaws (CVE\u20112025\u201123770 and CVE\u20112025\u201123771) to infiltrate vulnerable SharePoint servers. The campaign began in early July and has impacted sectors ranging from government and education to healthcare and large-scale enterprise.<\/p>\n\n\n\n Authentication spoofed, networks infiltrated<\/strong><\/p>\n\n\n\n The attackers were able to spoof authentication credentials, allowing them to impersonate authorised users and gain access to SharePoint environments. Once inside, they exfiltrated sensitive data, established backdoors, and in several cases moved laterally through the network undetected.<\/p>\n\n\n\n While Microsoft has not disclosed exact numbers, independent cybersecurity researchers estimate that between 400 and 500 organisations may have been compromised, among the affected are believed to be at least one U.S. federal agency.<\/p>\n\n\n\n \u201cThese attacks demonstrate a high level of sophistication,\u201d Microsoft stated, adding that the use of stolen access tokens and forged authentication cookies allowed the threat actors to maintain persistence and evade conventional defences. The activity observed, the company added, appears aligned with espionage and intelligence-gathering objectives.<\/p>\n\n\n\n State-sponsored cyber threats on the rise<\/strong><\/p>\n\n\n\n The groups identified in the attack\u2014each labelled with \u201cStorm\u201d designations\u2014are associated with China\u2019s state-sponsored cyber operations. Their activities form part of a growing pattern of cyber-enabled espionage targeting critical infrastructure, intellectual property, and strategic data.<\/p>\n\n\n\n This latest incident recalls past state-linked attacks such as the 2021 Microsoft Exchange vulnerabilities and the SolarWinds breach. What distinguishes this campaign is its focus on on-premises SharePoint servers\u2014systems that many organisations continue to run internally despite a broader shift towards cloud infrastructure.<\/p>\n\n\n\n Microsoft issues urgent remediation steps<\/strong><\/p>\n\n\n\n Microsoft released patches addressing the exploited vulnerabilities on 9 July. In addition to applying these updates immediately, the company is urging organisations to:<\/p>\n\n\n\n Microsoft also acknowledged the assistance of security partners such as Palo Alto Networks\u2019 Unit 42, who helped identify and track the ongoing campaign.<\/p>\n\n\n\n A wake-up call for legacy infrastructure<\/strong><\/p>\n\n\n\n The breach has underscored the dangers of outdated infrastructure and the lag in patch adoption across many enterprise environments. Microsoft warned that attackers will continue to exploit unpatched, internet-facing servers if organisations do not modernise their systems or follow robust security practices.<\/p>\n\n\n\n While SharePoint Online (the cloud-based version) remains unaffected, the company emphasised the importance of adopting zero-trust architecture, modern identity safeguards, and cross-cloud governance strategies\u2014especially for hybrid environments.<\/p>\n\n\n\n As the investigation continues, Microsoft\u2019s findings have added urgency to what many security professionals see as a critical moment: an inflection point where failing to patch legacy systems may pose as much risk as facing novel, AI-driven threats.<\/p>\n","protected":false},"excerpt":{"rendered":" Microsoft has confirmed that multiple China-based threat actors have exploited critical vulnerabilities in its on-premises SharePoint Server software, breaching the defences of hundreds of organisations worldwide in what is shaping up to be one of the most significant cyberattacks of 2025. In a detailed security blog published by the Microsoft Security Response Centre (MSRC), the […]<\/p>\n","protected":false},"author":4338,"featured_media":108252,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[18762,14804,19391,13],"tags":[1530,162,10,20066],"class_list":["post-124001","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai","category-cybersecurity","category-hot-topic","category-top-stories","tag-cybersecurity","tag-microsoft","tag-security-2","tag-sharepoint-breach"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/posts\/124001","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/users\/4338"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/comments?post=124001"}],"version-history":[{"count":1,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/posts\/124001\/revisions"}],"predecessor-version":[{"id":124006,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/posts\/124001\/revisions\/124006"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/media\/108252"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/media?parent=124001"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/categories?post=124001"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/tags?post=124001"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}\n