UK uncovers novel MS snooping malware, blames&sanctions GRU cyberspies

HELLFIRE

https://www.theregister.com/2025/07/20/uk_microsoft_snooping_russia/

… Authentic Antics periodically displays a login window that prompts the user to enter their credentials, and if they do, the malware steals the data, along with OAuth authentication tokens, which allow access to Microsoft services, including Exchange Online, SharePoint, and OneDrive. In addition, the malware exfiltrates victims’ data by sending emails from the victim’s account to an actor-controlled email address without the emails showing in the “sent” folder. …

Regards

px_eliezer_

Related…

SharePoint Under Attack: Microsoft Warns of Zero-Day Exploited in the Wild – No Patch Available

https://www.securityweek.com/sharepoint-under-attack-microsoft-warns-of-zero-day-exploited-in-the-wild-no-patch-available/

telcodad

Microsoft just issued an emergency patch for that vulnerability in its SharePoint software:

Microsoft releases emergency fix for Sharepoint after cyberattacks
CBS Moneywatch/AP - July 21, 2025
https://www.cbsnews.com/news/microsoft-sharepoint-attack-vulnerability-fix-released/

Microsoft issued an emergency fix to close off a vulnerability in its SharePoint software that hackers have exploited to carry out widespread attacks on businesses and at least some federal agencies: https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/

The software giant on Saturday said it was aware of “active attacks” that exploited vulnerabilities in the program, a product that allows companies and other businesses to create websites. The hackers breached U.S. federal and state agencies as well as universities and energy companies through the vulnerability, according to the Washington Post.

On Sunday, Microsoft updated its guidance with instructions to fix the problem for SharePoint Server 2019 and SharePoint Server Subscription Edition. Engineers were still working on a fix for the older SharePoint Server 2016 software. …..

HELLFIRE

https://www.theregister.com/2025/07/23/microsoft_sharepoint_400_orgs/ – Microsoft SharePoint victim count hits 400+ orgs in ongoing attacks, US DOE among breached government agencies

More than 400 organizations have been compromised in the Microsoft SharePoint attack, according to Eye Security, which initially sounded the alarm on the mass exploitation last Friday, even before Redmond confirmed the critical vulnerabilities. The Dutch security company on Wednesday reported four waves of attacks beginning July 17 and continuing the following two days, with “multiple waves” beginning July 21. …

Regards

HELLFIRE

https://www.theregister.com/2025/07/24/microsoft_sharepoint_ransomware/ – Microsoft: SharePoint attacks now officially include ransomware infections

… Late Wednesday, in an update to its earlier warning, Redmond confirmed that a threat group it tracks as Storm-2603 is abusing vulnerable on-premises SharePoint servers to deploy ransomware. … “Storm-2603 is then observed modifying Group Policy Objects (GPO) to distribute Warlock ransomware in compromised environments,” Microsoft said. …

Regards

HELLFIRE

https://www.theregister.com/2025/07/26/microsoft_sharepoint_attacks_leak/ – Blame a leak for Microsoft SharePoint attacks, researcher insists

A week after Microsoft told the world that its July software updates didn’t fully fix a couple of bugs, which allowed miscreants to take over on-premises SharePoint servers and remotely execute code, researchers have assembled much of the puzzle — with one big missing piece. How did the attackers, who include Chinese government spies, data thieves, and ransomware operators, know how to exploit the SharePoint CVEs in such a way that would bypass the security fixes Microsoft released the following day? …

Regards

Somewhat-Reticent

HELLFIRE Dunno ’bout Blame, but Suspect and Investigate.