A global cybersecurity crisis has been triggered by a newly discovered and unpatched vulnerability in Microsoft SharePoint Server, prompting the Governments of the United States, Canada, and Australia to conduct urgent investigations. In what experts are calling a coordinated and large-scale zero-day attack, which is a breach that takes advantage of a previously unknown security vulnerability, an exploit that enables remote code execution without the user's input, a critical flaw has been exploited to exploit a critical flaw that enables remote code execution without user interaction.
A widely used enterprise platform called SharePoint, which facilitates the sharing and collaboration of documents and ideas, has been identified as one of the latest attack vectors by threat actors looking to gain access to high-value systems. Thousands of servers are said to be vulnerable to the attack, with organisations across the public and private sectors scrambling to protect their systems since there has been no official security patch available from Microsoft for some time.
After this incident, concerns over Microsoft's security posture continue to grow, coming after a Chinese spying campaign in 2023 compromised email accounts belonging to U.S. government officials, including those belonging to the highest levels of the executive branch. As a result of the review, both the U.S. government and industry experts heavily criticised the company's security practices.
The latest breach highlights persistent vulnerabilities in widely-used platforms, as well as raising serious concerns about whether the global infrastructure is sufficiently prepared for sophisticated, evolving cyber threats that are rapidly evolving in complexity. There has been an increase in threats surrounding the SharePoint vulnerability following the emergence of a ransomware attack by the threat actor referred to as Storm-2603.
The group has changed its strategy from initially focusing on cyber-espionage operations to one focused on more destructive tactics, which is a troubling development in its campaign strategy. It appears that Storm-2603 is currently exploiting a vulnerable SharePoint flaw in order to infiltrate vulnerable systems and spread ransomware payloads. This is a worrying shift in the group's strategy.
By encrypting entire networks with malicious software, this malicious software demands cryptocurrency payments to restore access, effectively paralysing the operations of the targeted businesses. As a result of this strategic pivot, Microsoft announced this in a blog post released late Wednesday. During its extended analysis, it found that the transition from silent data theft to overt disruption and extortion had occurred over the past couple of years.
A ransomware campaign using this same zero-day vulnerability not only amplifies the threat posed by the campaign but also demonstrates that cybercriminal groups are blurring the line between espionage and financially motivated attacks as they become more prevalent in the world. As analysts warn, this dual-purpose exploitation could result in a greater financial and operational impact, especially for organisations that have not yet implemented compensating control or detection measures, which will lead to greater operational damage.
Moreover, this incident underscores the urgency of timely patching, comprehensive threat monitoring, as well as cross-border cybersecurity collaboration, which are all imperative to preventing any future attacks on SharePoint. Microsoft has attributed the ongoing exploitation of the SharePoint vulnerability to a threat group known as Storm-263, which is rated as based in China with moderate confidence.
Storm-2603 has not been directly connected to any other known Chinese threat actors, but has been linked to the attempted exfiltration of sensitive data, including MachineKeys, via on-premises SharePoint flaws. As of July 18, 2025, Microsoft has been observing the group actively deploying ransomware using the exploited vulnerability, despite not being directly linked to any Chinese threat actors.
An attack chain for this attack starts when a malicious payload (spinstall0.aspx) is executed on internet-exposed SharePoint servers in order to enable the execution of commands through the w3wp.exe process. In addition to conducting reconnaissance through tools such as whoami, cmd.exe, and batch scripts, Storm-2603 disables Microsoft Defender by altering the system registry.
An actor maintains persistence by installing web shells, creating scheduled tasks, and manipulating IIS components in a way that allows malicious .NET assemblies to be loaded and to maintain persistence. In order to move around and steal credentials, tools such as Mimikatz, PsExec, Impacket, and WMI are employed.
Ultimately, the operation results in the installation of the Warlock ransomware using modified Group Policy Objects (GPOs).
Moreover, Microsoft warns that other threat actors may exploit the same vulnerability, which emphasises the necessity of organisations to implement security mitigations and apply patches without delay to prevent further damage from occurring.
According to the CVSS scale, CVE-2025-53770 is the critical zero-day vulnerability at the centre of the ongoing exploitation campaign. It has been assigned a severity score of 9.8 on the CVSS scale, meaning it is a critical zero-day flaw.
There has been a classification given by security researchers for this vulnerability that which is a variation of the CVE-2025-49704 vulnerability that has been patched in the past, with a slightly less severe rating of 8.8. This vulnerability entailed code injection and remote code execution within Microsoft SharePoint Server.
Although Microsoft's Patch Tuesday release of July 2025 addressed the earlier flaw, the newly discovered variant has not been patched, which leaves many SharePoint environments running on-premises at risk.
A Microsoft advisory issued on July 19 says that the core problem stems from the derivation of untrusted data, which could lead to attackers remotely executing arbitrary code over a network without authenticating themselves.
According to the company, the exploit is a serious one, and a comprehensive fix is in the process of being developed and undergoing extensive testing at the moment.
Viettel Cyber Security has been credited with discovering the vulnerability via Trend Micro Zero Day Initiative (ZDI). The issue was reported to Trend Micro via the Zero Day Initiative (ZDI) and has been credited with the discovery.
As outlined in a separate security bulletin released by Microsoft on the following weekend, Microsoft has confirmed that an active exploit of the vulnerability is still in progress, specifically targeting on-premise deployments. However, according to the company, SharePoint Online services within Microsoft 365 are not affected by the threat.
A zero-day vulnerability known as CVE-2025-53770 has become a growing threat to the U.S. Cybersecurity and Infrastructure Security Agency (CISA) as a result of its increasing threats. Earlier this week, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a list of the Known Exploited Vulnerabilities (KEV) catalogue.
Federal agencies have a limited timeframe—until Monday—to implement immediate mitigations.
As a consequence of the active exploitation, according to Chris Butera, Acting Executive Assistant Director for Cybersecurity, the agency was alerted to the issue by a trusted partner, who promptly coordinated with Microsoft to resolve it.
Researchers have attributed this vulnerability to the broader version of CVE-2025-49706, a vulnerability that was previously patched by Microsoft for spoofing. This vulnerability has been referred to as "ToolShell" by researchers.
As the first cybersecurity firm to notice the attacks in action, Eye Security, a Dutch cybersecurity firm, reported that several high-profile targets, including multinational corporations, government institutions, and major banks, have already been compromised across several countries, including the United States, Germany, France, and Australia.
It has been stated by Eye Security CTO Piet Kerkhofs that attackers are executing large numbers of exploit waves to gain unauthorised control through the use of the remote code execution (RCE) flaw.
As a result of a technical analysis, it has been discovered that attackers are using the exploit to install web shells on compromised SharePoint servers and then to retrieve cryptographic keys from those servers.
Through these keys, adversaries can forge authentication tokens and retain privileged access even after patches have been applied. Microsoft has advised organisations to make sure that all SharePoint servers have Defender Antivirus installed and that the Antimalware Scan Interface (AMSI) is integrated into SharePoint.
In case AMSI implementation is not possible, Microsoft recommends that vulnerable SharePoint instances be temporarily disconnected from the internet until a full security update is made available. Note that this vulnerability does not affect users of SharePoint Online within Microsoft 365, which is the cloud-based version of SharePoint.
It has been reported that the CISA was first notified by a private cyber research firm on Friday of an active exploit of the SharePoint vulnerability, and Microsoft has been immediately notified, according to a spokesperson for the agency. A number of critical questions have been raised once again regarding Microsoft’s vulnerability management procedures as a result of this incident.
There has previously been controversy surrounding the company due to its narrowly focused patches that do not often address similar attack paths, leaving organisations vulnerable to follow-up attacks that target similar exploits.
It has been reported that Microsoft, one of the largest technology providers to global governments, has experienced a number of cybersecurity failures over the past two years, including attacks on its corporate infrastructure and executive email accounts, among other high-profile incidents.
The Chinese government-backed threat actors were able to access federal official emails by exploiting a programming flaw in Microsoft's cloud services in one major incident.
In addition, controversy was sparked after investigative outlet ProPublica reported Microsoft had hired engineers based in China to work on Department of Defence cloud projects. In response to the report, Defence Secretary Pete Hegseth immediately inspected the Pentagon cloud contracts and a formal review was initiated.
Additionally, the nonprofit Centre for Internet Security (CIS) warned more than 100 vulnerable organisations, including public schools and universities, that they were at risk of being compromised by the threat. While Randy Rose, Vice President of CIS, indicated that incident response efforts had been significantly delayed as a result of a 65% cut to funding, CISA has had to significantly reduce its threat intelligence staffing.
In the future, this incident should serve as a crucial turning point for enterprises as they attempt to develop a comprehensive cybersecurity strategy beyond immediate containment. Organisations will need to adopt a mindset of continuous vigilance, integrating secure architecture with timely intelligence sharing, and automating threat detection into their operational DNA.
When threat actors are constantly adapting and repurposing vulnerabilities, it is no longer sufficient to rely on vendor assurances without independent validation, especially in an environment where threat actors are constantly adapting and repurposing vulnerabilities. To minimise the blast radius in the event of a breach, organisations should prioritise scenario-based resilience planning, routine red teams, and strict access governance.
Additionally, a close alignment between cybersecurity, legal, and executive leadership is essential in order to make informed decisions at the speed of modern threats. There is more to security than patchwork responses, as the threat matrix is evolving; it requires a security-first culture that is backed by investment, accountability, and strategic planning.
