Archive · 24 Jul 2025
SharePoint Hackers Now Deploy Ransomware, Microsoft Reports
Imagine some bad guys found a way to break into Microsoft's computer servers.
They're using this trick to lock up important files and demand money, a process called ransomware.
These hackers, known as Storm-2603, are targeting computers using vulnerable versions of Microsoft's SharePoint software.
Once they get in, they shut down the computer systems until the owners pay a ransom, like a digital ransom.
Hundreds of companies and organizations have already been affected, with the actual number likely even higher.
The National Institutes of Health is one confirmed victim, with servers isolated as a precaution.
This all started because Microsoft missed fixing a security flaw.
Microsoft reports that hackers exploiting SharePoint vulnerabilities now deploy ransomware.
The group 'Storm-2603' uses the vulnerability to deploy ransomware that disrupts networks until a ransom is paid.
The campaign has affected at least 400 victims, with the number likely higher.
A representative for the National Institutes of Health confirmed one of its servers was compromised.
The attacks began after a security hole in Microsoft's SharePoint server software was exploited.
- Who
- A group dubbed "Storm-2603".
- What
- A cyber-espionage campaign using SharePoint vulnerabilities now involves ransomware.
- When
- Reported late Wednesday
- Where
- No specific locations mentioned.
- Why
- To disrupt networks and extort money through ransomware.
Microsoft/Eye Security
N/A
Attack Reporting
Microsoft/Eye Security
Reports on the attacks and provides insights into the evolving tactics.
N/A
N/A
- Group Name
- Storm-2603
- Affected Software
- Microsoft SharePoint server
- Primary Attack Type
- Ransomware
- Estimated Victims
- At least 400
- Victim Example
- National Institutes of Health