Archive · 24 Jul 2025
Microsoft Warns of Ransomware Attacks via SharePoint Server
Some hackers are using a security flaw in Microsoft's SharePoint software to break into computer systems.
They're now using ransomware, which locks up the computers and demands money to unlock them.
At least 400 organizations have been hit, and some U.S. government agencies may be affected.
This started because Microsoft didn't fully fix a security problem.
Now, the hackers are causing major disruptions by blocking access to important data until the victims pay them.
Microsoft says hackers exploiting SharePoint are now deploying ransomware.
The cyber-espionage campaign has affected at least 400 victims.
Ransomware is being used to paralyze victims' networks for payment.
The Department of Homeland Security and other U.S. agencies may have been breached.
The campaign started after a security hole in Microsoft's SharePoint server software was exploited.
- Who
- A group dubbed 'Storm-2603' is deploying the ransomware; Chinese hackers are alleged to be involved.
- What
- Hackers are deploying ransomware after exploiting vulnerabilities in Microsoft's SharePoint server software.
- When
- The campaign began after a security hole was discovered, with an escalation to ransomware deployment recently.
- Where
- The attacks have affected various organizations, including potentially U.S. government agencies.
- Why
- To cause widespread disruption and demand payment, while taking advantage of a software vulnerability.
- Affected Software
- Microsoft SharePoint Server
- Type of Attack
- Cyber-espionage and Ransomware
- Victims
- At least 400 organizations
- Ransomware Goal
- Paralyzing networks for payment
- Potential Victims
- U.S. government agencies, including DHS and NIH
- Blame
- Microsoft and potentially China