US Nuclear Weapons Data Compromised via SharePoint Zero-Day Attack

A significant cybersecurity breach has exposed vulnerabilities in critical US government infrastructure, as the National Nuclear Security Administration (NNSA) was reportedly compromised through a Microsoft SharePoint zero-day exploit linked to Chinese government-affiliated hacking groups.

Chinese Hackers Target Critical Infrastructure

The breach came to light hours after Microsoft disclosed that Chinese government-affiliated hacking groups had been exploiting a previously unknown vulnerability in its SharePoint software.

According to Bloomberg News, the NNSA, which plays a crucial role in providing the Navy with nuclear reactors for submarines, was among the victims of this sophisticated cyber attack.

The zero-day vulnerability has impacted more than 50 organizations in recent days, demonstrating the widespread nature of this security threat.

The exploit specifically targets on-premises versions of SharePoint, while leaving the SharePoint Online service that Microsoft operates as part of its Microsoft 365 cloud service unaffected.

Despite the concerning nature of the breach, officials maintain that no sensitive or classified information was compromised during the attack.

The relatively minimal impact appears to be attributed to the Department of Energy’s strategic reliance on Microsoft 365 cloud systems for most of its SharePoint operations.

“The department was minimally impacted due to its widespread use of the Microsoft M365 cloud and very capable cybersecurity systems,” a Department of Energy spokesperson stated.

The official added that “a very small number of systems were impacted” and confirmed that “all impacted systems are being restored”.

Microsoft has since patched all versions of SharePoint affected by the zero-day exploit.

The vulnerability was particularly dangerous because it allowed hackers to remotely access SharePoint servers, enabling them to steal data, passwords, and potentially move across connected services.

Security researchers have traced the exploit’s origins to a combination of two bugs that were initially presented at the Pwn2Own hacking contest in May.

This timeline suggests that the vulnerabilities may have been known in certain circles before being weaponized by threat actors.

The incident highlights the ongoing cybersecurity challenges facing critical US infrastructure, particularly as state-sponsored actors continue to target government systems.

 The fact that nuclear weapons-related agencies were affected, even minimally, underscores the high-stakes nature of modern cyber warfare and the importance of robust defensive measures.

While the immediate threat appears contained, this breach serves as a stark reminder of the persistent vulnerabilities in government IT systems and the need for continued vigilance against sophisticated state-sponsored cyber attacks.

Get Free Ultimate SOC Requirements Checklist Before you build, buy, or switch your SOC for 2025 - Download Now