Microsoft links Sharepoint ToolShell attacks to Chinese hackers
A recent round of massive attacks targeting a Microsoft SharePoint zero-day vulnerability chain has implicated a number of hacker groups with connections to the Chinese government.
After breaking into their on-premise SharePoint servers, they exploited this chain of exploits (named "ToolShell") to compromise dozens of companies throughout the globe.
In a research released on Tuesday, Microsoft noted that it had seen two specific Chinese nation-state actors, Linen Typhoon and Violet Typhoon, take use of these flaws to target SharePoint systems that are accessible over the internet. Furthermore, we have seen that Storm-2603, a threat actor based in China, is taking advantage of these weaknesses. The use of these exploits by other actors is still being investigated.
We conclude that...