Microsoft Hack Hits Hundreds of Firms, Agencies as Damage Spreads

(Bloomberg)-According to a research company, the number of companies and organizations that are compromised on a vulnerability on the Sharepoint servers of Microsoft Corp.’s Sharepoint servers is rapidly increasing and according to a research company, the victims rise more than six times in a few days.

According to estimates of eye safety, the Netherlands Cyber Security Company, which determined an early wave of attacks last week, violated approximately 400 state institutions, companies and other groups. This came from about 60 based on the previous estimate given to Bloomberg News on Tuesday.

The security company said that most of the victims were in the US and followed by Mauritius, Jordan, South Africa and the Netherlands. Bloomberg, the US agency responsible for protecting and designing the nuclear weapon cache of the nation, was among those who were violated.

According to a person familiar with the issue, National Health Institutes were also affected by SharePoint flaws. “Department and Security Teams are actively interested in monitoring, identifying and reducing all the risks for our IT systems that emerged by Microsoft SharePoint vulnerability.” He said.

“Currently, there is no symptom that any information is violated as a result of this fragility, and added that the department cooperates with Microsoft and the US Cyber Security and Infrastructure Security Agency. The Washington Post reported that NIH had been violated before.

And the South African National Treasury added that after discovering malware in his network, he was looking for help from Microsoft, but his systems and websites work normal.

Hacks are among the latest major violations that Microsoft accused at least partly in China and blames among the global security and trade between Washington and Beijing. The United States has repeatedly criticized China for campaigns that have been stolen government and institutional secrets for decades.

Vaisha Bernard, owner of Eye Security, said in an e-mail sent to Bloomberg News, “The number of real victims from Sharepoint abuse“ may be much higher because it can be much higher because it may be much higher ways to endanger the servers that do not leave any traces. “

Bernard said that many people working in government, education and technology services of the organizations that were in danger in Sharepoint violations. In Europe, Asia, Middle East and South America, there were fewer victims.

According to Sveva Senarelli, a state -backed computer pirates, a future INC -saved threat analyst, the SharePoint tends to use in waves from large cyber security weaknesses, such as a vulnerability. The secret, they start with the targeted hackers, and after they are discovered later, they will start using it more indecisive.

“After accessing access, individual threat groups can then trigger the endangered organizations and give priority to special interest for the following activity,” he said. He said that it may involve ways to maintain access to a dangerous network, to descend deeper and to set ways to steal sensitive information.

In a Bloomberg television interview on Wednesday, US Treasury Secretary Scott Bessent, who proposes that SharePoint Hack will be discussed, will meet for the third round trade talks in Stockholm next week. “Frankly things will be on the agenda with my Chinese colleagues,” he said.

Security flaws allow computer pirates to play switchs that can allow users or services to access Sharepoint servers and steal the keys that allow them to steal hidden data to potentially agreed networks. Microsoft released patches to correct security gaps, but researchers warned that pirates may have already had a basis for many servers.

On Tuesday, Microsoft accused Chinese state -supported computer pirates of being behind the attacks, known as Keten Typhoon and Violet Typhoon. According to the company, another Chinese-based hacking group, which Microsoft was looking for Storm-2603, exploited them.

Redmond, Washington Company repeatedly accused China for major cyber attacks. In 2021, tens of thousands of Microsoft Exchange, alleged to be China’s operation, endangered the server. In 2023, another China’s attack on Microsoft Exchange endangered the E -Posta accounts of senior US officials. A US government investigation later accused Microsoft of the 2023 incident of a “gradual safety failures”.

Eth Zurich, who specializes in analyzing Chinese cyber attacks, said that Eugenio Benicasa, a researcher at the Security Research Center, was accused of allegedly involved in the Hack campaigns that have previously been involved in the US organizations in the United States. The authority is known for their “comprehensive espionage ..

According to Benincasa, Sharepoint violations are carried out by the government’s power of attorney groups instead of Chinese government agencies that perform directly hacking. Authorized, private hacking companies in the country sometimes participated in “hacker for rire” operations, he added.

“Now, at least three groups have been reported to use the same vulnerability, it is reasonable that it can follow more.”

China Foreign Ministry spokesman Guo Jiakun said, “Cyber security is a widespread challenge faced by all countries and should be handled jointly through dialogue and cooperation,” he said. “China opposes and struggles with hacking activities in accordance with the law. At the same time, we oppose the attacks on Smears and China under the excuse of cyber security issues.”

According to Microsoft, the hacking group Linen Typhoon was first identified in 2012 and focused on stolen intellectual property targeting the government, defense, strategic planning and human rights -related organizations. Violet Typhoon, which was first observed in 2015, was “dedicated to espionage” and primarily targeted the media and education sectors in the United States, Europe and East Asia as well as former government and military personnel, non -governmental organizations.

Bloomberg also used Sharepoint flaws to enter the systems of the US Education Department, Florida Revenue Department and Rhode Island General Assembly.

Edwin Lyman, Director of Nuclear Power Safety Director of the Association of Scientists, said that although the National Nuclear Security Administration has the most limited and dangerous information in the world, the networks in which classified information are stored are isolated from the internet.

“Even if these networks are endangered, I am not sure how such information can be transmitted to competitors, L “However, there are other categories of information that may be sensitive but not classified, less carefully and may be exposed. This contains some information about nuclear materials and even nuclear weapons.”

-Lille Liu, Ari Natter and Jessica Nix help.

(In the sixth paragraph, updates with South Africa Hack. A previous version corrected Rhode Island’s writing.)

There are more stories like this Bloomberg.com