Archive · 24 Jul 2025
SharePoint Cyberattack Escalates: Ransomware Impacts Hundreds
A group of hackers, known as Storm-2603, is using a weakness in Microsoft's SharePoint software to cause trouble.
They're now using this to lock up computer systems and demand money, called ransomware.
They've already hit at least 400 organizations, including parts of the US government.
This is a change from what they were doing before, which was mostly spying.
Microsoft and Google say these hackers are from China, but China denies it.
This all started because a security flaw in the software wasn't completely fixed.
A cyber-espionage campaign targeting Microsoft SharePoint servers has escalated to ransomware.
The hacking group "Storm-2603" is deploying ransomware via a known SharePoint vulnerability.
At least 400 organizations are known to be affected, including US government institutions.
The National Institutes of Health confirmed a server compromise.
Microsoft and Google have attributed the campaign to Chinese state-backed hackers, a claim denied by the Chinese government.
- Who
- The hacking group Storm-2603, suspected to be backed by the Chinese state.
- What
- A cyberattack involving ransomware deployed through a vulnerability in Microsoft SharePoint servers.
- When
- The attack wave began after Microsoft failed to completely patch a known security flaw.
- Where
- Affecting organizations globally, including the US government and US private sectors.
- Why
- To disrupt and extort money from organizations by encrypting their data and demanding ransom.
Accusation
Denial
Attribution
Accusation
Microsoft and Google accuse Chinese state-backed hackers.
Denial
China denies any involvement in the cyberattacks.
- Hacking Group
- Storm-2603
- Target
- Microsoft SharePoint Servers
- Attack Type
- Ransomware deployment
- Affected Organizations (minimum)
- 400
- Victims include
- US Government and private organizations
- Attribution
- Attributed to Chinese state-backed hackers by Microsoft and Google
- Denial
- The Chinese government denies involvement