Microsoft server hack now has 400 victims
By: James Pearson
Reuters
LONDON - A security patch released by Microsoft earlier in July [2025] failed to fully fix a critical flaw in the U.S. tech company's SharePoint server software that has been identified at a hacking competition in May, [2025] opening the door to a sweeping global cyber espionage operation, according to a timeline of events reviews by Reuters.
.....
A Microsoft spokesperson confirmed on July 22 [2025] that tis initial solution did not work but added that Microsoft had released further patches that fixed the issue. It remains unclear who is behind the ongoing operation, which targeted around 100 organizations over the July 19-20 [2025] weekend.
..... Researchers at Netherlands-based Eye Security said there are now about 400 victims. The number is expected to escalate as other hackers join the fray. Microsoft said in a blog post that two allegedly Chinese hacking groups, dubbed :Linen Typhoon" and "violet Typhoon," were exploiting the vulnerabilities, along with another China-based hacking group.
.....
Microsoft and Alphabet's Google have said that China-linked hackers were likely behind the first wave of hacks. Chinese government-linked operatives are regularly implicated in cyberattacks, but Beijing routinely denies carrying out hacking operations, In an emailed statement, the Chinese embassy in Washington said China opposes all forms of cyberattacks and "smearing others without solid evidence."
...... The vulnerability hat facilitated the attack was first identified in May [2025] at a hacking competition in Berlin organized by cybersecurity firm Trend Micro, which offered cash bounties for the discovery of computer bugs in popular software,
..... It offered A $100,000 prize for "zero-day" exploits - which are called that because they leverage previously undisclosed digital weaknesses.
.....
At the event, a researcher working for the cybersecurity arm of Viettel, a telecommunications from operated by Vietnam's military, identified a bug that could be sued ageist SharePoint, Microsoft's flagship document management and collaboration platform, and demonstrated a method of exploiting it.
..... Microsoft said in a Jul 8 [2025] security update that it had identified the bug, listed it as a critical vulnerability and released patches to fix ii.
.....
About 10 days later, however, cybersecuity firms stated to notice an influx of malicious Online exploit: targeting the same software the bug sought to exploit: SharePoint servers. "threat actors subsequently developed exploits that appear to bypass these patches," British cybersecurity firm Sophos said in a blog post on July 21. [2025]
..... The pool of potential targets remains vast. According to data from Shodan, a reach engine that helps identify Internet-linked equipment, over 8,000 servers Online could have already been compromised.
..... Those servers include major industrial firms, banks, auditors, health care companies, and several U.S. state-level and international government entities.
..... the Shadow server Foundation, which scans the INTERNET for potential digital vulnerabilities, put the number at a little more than 9,000, while cautioning hat the figure was a minimum. It said most of those affected were in the United States and Germany, and the victims included government organizations, Germany's federal office for information security, BSI, said on July 22 [2025] it had found SharePoint servers within government networks that were vulnerable to the toolShell attack but that none had been compromised.