Stock market today: S&P 500 ekes out closing record high despite wobble in chips
Investing.com -- Microsoft (NASDAQ:MSFT) has identified Chinese hackers exploiting vulnerabilities in on-premises SharePoint servers, leading to worldwide breaches in recent days.
In a July 19 blog post, Microsoft Security Response Center detailed active attacks against SharePoint servers exploiting two critical vulnerabilities: CVE-2025-49706 (a spoofing vulnerability) and CVE-2025-49704 (a remote code execution vulnerability). The company has released comprehensive security updates for all supported versions of SharePoint Server to address these and related vulnerabilities.
Microsoft has observed three China-based threat actors exploiting these vulnerabilities: Linen Typhoon, Violet Typhoon, and Storm-2603. The company expects more threat actors to integrate these exploits into their attacks against unpatched systems.
The attackers have been observed conducting reconnaissance and attempting exploitation through POST requests to the ToolPane endpoint. After successful exploitation, they deploy web shells named "spinstall0.aspx" (or variations) to steal machine key data, enabling persistent access.
Microsoft recommends customers immediately apply security updates, enable Antimalware Scan Interface (NASDAQ:TILE) (AMSI) in Full Mode, rotate SharePoint server ASP.NET machine keys, restart Internet Information Services (NASDAQ:III), and deploy Microsoft Defender for Endpoint or equivalent solutions.
The exploitation attempts began as early as July 7, according to Microsoft’s analysis. Linen Typhoon has historically focused on stealing intellectual property from government and defense organizations, while Violet Typhoon targets former government personnel, NGOs, and educational institutions. Storm-2603 has previously deployed ransomware, though Microsoft cannot currently assess its objectives in these attacks.
Microsoft emphasized that these vulnerabilities only affect on-premises SharePoint servers and do not impact SharePoint Online in Microsoft 365.
This article was generated with the support of AI and reviewed by an editor. For more information see our T&C.