A newly discovered critical flaw in Microsoft’s SharePoint platform has spurred a mad frenzy from hackers — including some working for the Chinese government, Google and Microsoft say.
The identities of which organizations have been hacked are still not public, but they are increasing and include multiple government agencies around the world, Charles Carmakal, the chief technology officer at Mandiant, Google’s cloud security service, told NBC News.
SharePoint works as a shared version of Microsoft Office, letting people in the same organization directly collaborate.
The flaw in the software — initially classified as a “zero day,” because there was not a patch for victims to defend themselves when it was first discovered — lets hackers gain significant access to the computers of organizations that host SharePoint. Cloud customers were not affected.
Microsoft announced Saturday that the flaw was being exploited but only made a downloadable fix for it available Monday, prompting a scramble for organizations to patch it while capable hackers hurried to find additional victims who hadn’t protected themselves.
The incident echoes one in 2021, when a flaw in another Microsoft product, the email program Exchange, allowed a similar mad dash of hacking. In that case, the U.S. formally accused China of snooping on government emails, but a review board also blamed Microsoft for allowing it to happen.
In a blog post published Tuesday morning, Microsoft said at least three Chinese hacking groups, two of which are associated with Chinese intelligence, have been exploiting the flaw.
The U.S. government and its allies, as well as Western cybersecurity companies, routinely attribute cyber espionage efforts to China, which often downplays the accusations. A spokesperson for China’s Embassy in Washington did not directly deny that Chinese intelligence has been using the exploit, but said, “Cyber attacks are a common threat faced by all countries, China included.”
“China firmly opposes and combats all forms of cyber attacks and cyber crime — a position that is consistent and clear,” the spokesperson said.
Neither the White House nor the Cybersecurity and Infrastructure Security Agency, which protects U.S. federal networks, responded to a request for comment.
