The new China-based Storm-2603 group is deploying Warlock ransomware on Microsoft SharePoint servers.
Posted inCybersecurity News

The new China-based Storm-2603 group is deploying Warlock ransomware on Microsoft SharePoint servers.

A sophisticated cyber threat actor known as Storm-2603 has been identified exploiting critical vulnerabilities in Microsoft SharePoint to deploy Warlock ransomware on unpatched enterprise systems. According to Microsoft’s recent security advisory, this group, believed to be China-based, is leveraging unpatched flaws in on-premises SharePoint servers to gain unauthorized access, establish persistence, and spread ransomware across targeted networks.
The agency responsible for overseeing America’s nuclear weapons stockpile was a victim of the China’s recent SharePoint Frenzy attack.
Posted inCybersecurity News

The agency responsible for overseeing America’s nuclear weapons stockpile was a victim of the China’s recent SharePoint Frenzy attack.

The U.S. National Nuclear Security Administration (NNSA), the agency responsible for overseeing America’s nuclear weapons stockpile, was among several government institutions recently targeted in a widespread cyberattack that exploited critical vulnerabilities in Microsoft’s on-premises SharePoint software.
Microsoft SharePoint ToolShell attacks linked to Chinese-state hackers.
Posted inCybersecurity News

Microsoft SharePoint ToolShell attacks linked to Chinese-state hackers.

A major wave of cyberattacks, referred to as “ToolShell,” has recently targeted Microsoft SharePoint servers around the world. These attacks have been attributed to Chinese state-linked hackers and have affected government agencies, critical infrastructure, universities, and multinational corporations. The campaign exploited a chain of zero-day vulnerabilities in on-premises versions of Microsoft SharePoint, allowing for unauthenticated remote code execution and full system compromise.
Microsoft SharePoint zero-day exploited in remote code execution attacks around the world.
Posted inCybersecurity News

Microsoft SharePoint zero-day exploited in remote code execution attacks around the world.

Categorized as a remote code execution (RCE) flaw, this vulnerability is currently being exploited on a large scale, allowing attackers to take complete control of exposed on-premises SharePoint servers. As government agencies, educational institutions, energy sector, and major enterprises scramble to secure their infrastructure, understanding the mechanics, impact, and mitigations for this attack has become paramount.