Microsoft knew of SharePoint security flaw in May, initial patch ineffective

A security patch released by Microsoft earlier this month failed to fully fix a critical flaw in the company’s SharePoint server software that was identified at a hacking competition in May, opening the door to a sweeping global cyber espionage operation, according to an events timeline reviewed by Reuters.

A Microsoft spokesperson confirmed that its initial solution did not work, but added that further patches released had fixed the issue.

It remains unclear who is behind the ongoing operation, which targeted around 100 organisations over the weekend and is expected to escalate as other hackers join the fray.

Microsoft said in a blog post that two allegedly Chinese hacking groups, dubbed “Linen Typhoon” and “Violet Typhoon,” were exploiting the vulnerabilities, along with another China-based hacking group.

Microsoft and Alphabet’s Google said that China-linked hackers were likely behind the first wave of hacks.

Chinese government-linked operatives are regularly implicated in cyberattacks, but Beijing routinely denies carrying out hacking operations.

In an emailed statement, the Chinese embassy in Washington said China opposes all forms of cyber attacks, and “smearing others without solid evidence.” 

The vulnerability that facilitated the attack was first identified in May at a hacking competition in Berlin organised by cyber security firm Trend Micro, which offered cash bounties for the discovery of computer bugs in popular software.

It offered a US$100,000 (A$153,000) prize for “zero-day” exploits, solutions to previously undisclosed digital weaknesses that could be used against SharePoint.

A researcher working for the cybersecurity arm of Viettel, a telecommunications firm operated by Vietnam’s military, identified a bug in SharePoint at the event, dubbed it “ToolShell” and demonstrated a method of exploiting it. 

Microsoft said in a July 8 security update that it had identified the bug, listed it as a critical vulnerability, and released patches to fix it. 

About 10 days later, however, cyber security firms started to notice an influx of malicious online activity targeting the same software the bug sought to exploit: SharePoint servers.

“Threat actors subsequently developed exploits that appear to bypass these patches,” British cyber security firm Sophos said in a blog post on July 21. 

The pool of potential ToolShell targets remains vast.

According to data from Shodan, a search engine that helps identify internet-linked equipment, over 8,000 servers online could theoretically have already been compromised by hackers.

Those servers include major industrial firms, banks, auditors, healthcare companies, and several US state-level and international government entities. 

The Shadowserver Foundation, which scans the internet for potential digital vulnerabilities, put the number at a little more than 9,000, while cautioning that the figure was a minimum. 

It said most of those affected were in the United States and Germany, and the victims included government organisations.

Germany’s federal office for information security, BSI, said on July 22 it had found SharePoint servers within government networks that were vulnerable to the ToolShell attack, but none had been compromised.