Hackers use Microsoft service to launch serious global attack at governments and businesses

Microsoft has confirmed that vulnerabilities within its SharePoint service are being actively exploited by hackers who are targeting government entities and multinational corporations.

2

The serious security vulnerability dates back to May 2025 when researchers from Viettel Cyber Security discovered and demonstrated a Microsoft SharePoint exploit in a "ToolShell" attack that is now being actively exploited by hackers around the world.

For those unfamiliar, Microsoft SharePoint is a service used by organizations to store and manage documents, create internal websites, share files, build workflows, and facilitate team collaboration. The security flaws are related to SharePoint servers being hosted by organizations themselves, not cloud-based SharePoint.

Two critical zero-day vulnerabilities in on-premises SharePoint servers (CVE-2025-53770 & CVE-2025-53771) are allowing third parties to take over servers without requiring credentials. These exploits have already led to the compromise of at least 85 servers worldwide.

Microsoft attempted to patch the vulnerabilities in a recent July security update, but those patches have already been bypassed by malicious third parties, rendering SharePoint Server installations of the following vulnerable to infiltration:

Vulnerable SharePoint Versions

• SharePoint 2016
• SharePoint 2019
• SharePoint Subscription Edition

So far, 54 organizations have been hit as a result of the security vulnerabilities, which include government agencies, businesses, and universities. Eye Security, a Dutch cybersecurity startup founded in 2020, and one of the first firms to detect and track the SharePoint zero-day attacks, says that many entities using SharePoint are likely already compromised but not yet identified, especially if they haven't implemented Microsoft's mitigation and detection tools.

Confirmed Breaches

Government & Public Sector

• U.S. Federal Agencies (at least 2, unnamed)
• State Legislature (Eastern U.S., public document repository hijacked)
• Florida State Agency
• Local Government Agency - Albuquerque, New Mexico
• Government Agency - Spain
• European Government Agencies (several, unnamed)
• Arizona State & Tribal Governments (emergency response initiated)
• Public Sector Organizations alerted by the Center for Internet Security (approx. 100, unnamed)

Education Sector

• Private University - California, USA
• University - Brazil
• Multiple U.S. Public Schools and Universities (alerted by CIS)

Energy & Utilities

• Energy Company - Large U.S. State (tracked by Eye Security)
• Private Energy Operator - California, USA

Private Sector

• Fintech Company - New York, USA
• AI Technology Firm - (unnamed)
• Asian Telecommunications Company - (unnamed)
• Multiple organizations in China (targeted)