Microsoft SharePoint Vulnerabilities Exploited in Widespread Ransomware Attacks
TL;DR
Microsoft reports that the threat group Storm-2603, suspected to be China-based, is exploiting SharePoint vulnerabilities (CVE-2025-49706 and CVE-2025-49704) to deploy Warlock ransomware, using web shells, credential harvesting, and lateral movement techniques. Users are advised to update SharePoint, apply security patches, and implement security best practices to mitigate the threat.
- Storm-2603 Exploits SharePoint Flaws to Deploy Warlock Ransomware on Unpatched Systems The Hacker News
- Disrupting active exploitation of on-premises SharePoint vulnerabilities Microsoft
- DHS and HHS among federal agencies hacked in Microsoft Sharepoint breach CBS News
- Chinese Hackers Are Exploiting Flaws in Widely Used Software, Microsoft Says The New York Times
- Microsoft Hack Hits Hundreds of Firms, Agencies as Damage Spreads Yahoo Finance
Want the full story? Read the original reporting
Read on The Hacker News