Microsoft cyberattack hits 100 organisations, security firms say

Over 100 different businesses have been hacked over the weekend by a massive cyber espionage operation that targets Microsoft server software&nbsp.

On Monday, two of the organizations that helped to find the attack made their findings public.

Microsoft issued a warning on Saturday about “active attacks” on self-hosted SharePoint servers, which businesses use frequently to collaborate and share files among themselves. Unaffected were SharePoint instances that were running on Microsoft servers.

The hacks, which use a previously unnamed digital weakness to allow spies to hack vulnerable servers and potentially unlock a backdoor to keep track of the victims’ organizations, are known as “zero-day” because they make use of it.

An internet scan conducted with the Shadowserver Foundation on Friday, according to Vaisha Bernard, the head hacker at Eye Security, a Dutch-based cybersecurity firm that found the hacking campaign targeting one of its clients, had identified nearly 100 victims before the hack’s methodology became widely known.

Bernard remarked, “It’s unambiguous.” Who is aware of the actions that other adversaries have taken since introducing new backdoors?

He said the relevant national authorities had been informed, but he continued to name the affected organizations.

The Shadowserver Foundation confirmed the 100-person figure, claiming that government organizations were most frequently victims and that the majority of the affected people were from the United States and Germany.

According to another researcher, the spying has sounded like it was the product of a single hacker or group of hackers.

Rafe Pilling, director of threat intelligence at British cybersecurity firm Sophos, said, “It’s possible that this will change very quickly.”

In an email message, a Microsoft spokesperson said it had “provided security updates and encourages customers to install them.”

Who was responsible for the ongoing hack was unknown. The FBI did not provide any additional information, but it did state that it was aware of the attacks and was working closely with its federal and private sector partners on Sunday. The National Cyber Security Centre of Great Britain announced in a statement that it was aware of “a limited number” of targets in the country. According to a researcher monitoring the hacks, the initial target group of government-related organizations was initially identified as the campaign.

Potential targets

There are still many potential targets in the pool. More than 8, 000 online servers could theoretically have already been hacked, according to data from Shodan, a search engine that helps identify internet-linked equipment.

Major industrial companies, banks, auditors, healthcare providers, and a number of US state-level and international government entities are among those servers.

According to Daniel Card of British cybersecurity consultancy PwnDefend, “the SharePoint incident appears to have caused a wide level of compromise across a range of servers globally.”

It’s wise to approach this scenario with an assumed breach, but it’s also crucial to grasp that the patch itself is not sufficient.