Ransomware Surge Prompts Swift Global Response, Reveals New SharePoint Zero-Day Attacks

A critical vulnerability in Microsoft SharePoint has raised concerns across the cyber community. Discovered to have been under exploitation as early as July 7, 2025, the SharePoint zero-day flaw has allowed threat actors—including alleged state-backed groups—to steal sensitive encryption keys and establish persistent, unauthorized access within affected networks. Evidence points to Chinese hackers leveraging this exploit for espionage, targeting organizations reliant on SharePoint for managing internal documents and communications ^{[1] [2] [3]}.

The exploitation of this vulnerability has also enabled ransomware groups such as Storm-2603 to launch campaigns against organizations using on-premises SharePoint installations. These attackers have not only deployed ransomware but also exfiltrated sensitive data, increasing both operational and reputational risks for victims. The rapid succession of these attacks underscores the importance for system administrators to quickly apply available security patches and for organizations to strengthen their incident response procedures ^[4].

In parallel with these technical defenses, governments are enacting new policies to combat ransomware. The UK government announced plans to ban public sector and critical infrastructure organizations from paying ransoms to hackers. This measure, alongside laws mandating the prompt reporting of ransomware incidents, aims to disrupt the business model of cybercriminals—many of whom are believed to be operating from Russia—and reduce the overall incentive for attacks that ransom sensitive data or critical operations ^{[5] [6]}.

Despite the alarming nature of these cyber incidents, there are reasons for optimism. Security researchers and IT professionals have mobilized rapidly, identifying attack vectors and disseminating guidance for patching and mitigation. The increased readiness and cooperation between public and private sectors, as well as international collaboration, signify a strengthening digital defense posture. Proactive workshops and resources are enabling organizations to better secure core infrastructure, such as Active Directory and SharePoint, fostering a more resilient approach to inevitable future challenges ^[7].

1. Hackers Exploit SharePoint Zero-Day Since July 7 to Steal Keys, Maintain Persistent Access
2. Faille Microsoft SharePoint, une affaire d’espionnage chinois ?
3. Falla critica in SharePoint, hacker cinesi colpiscono le aziende
4. Storm-2603 spotted deploying ransomware on exploited SharePoint servers
5. UK To Ban Public Sector Orgs From Paying Ransomware Gangs
6. British institutions to be banned from paying ransoms to Russian hackers
7. heise-Angebot: iX-Workshop: Lokales Active Directory gegen Angriffe absichern