The initial wave of attacks exploiting a zero-day vulnerability in Microsoft SharePoint servers has predominantly targeted government organizations, according to researchers and news reports. The U.S. cybersecurity agency CISA issued an alert over the weekend, warning about hackers exploiting this previously unknown bug in Microsoft’s SharePoint product. Silas Cutler, principal researcher at Censys, noted that the hackers initially focused on government entities, with the potential for more widespread breaches as other attackers replicate the exploitation.
As the vulnerability remains unpatched by Microsoft, Cutler warned that non-government hackers may also exploit it. Reports indicate thousands of vulnerable SharePoint instances accessible online, with evidence of compromised servers. It is believed that the hackers behind the attacks are part of an advanced persistent threat group. The Washington Post revealed that U.S. federal and state agencies, universities, and energy companies were among the targets.
Microsoft clarified that the vulnerability affects SharePoint versions installed on local networks, not cloud versions. Organizations using SharePoint servers are advised to apply the patch or disconnect them from the internet to mitigate the risk of exploitation.
