SharePoint Zero-Day Exploit Targets Government Agencies

SharePoint Zero-Day Exploitation: Initial Targets Identified

Investigations suggest that the initial attacks leveraging a zero-day vulnerability in Microsoft SharePoint servers have predominantly focused on governmental entities, as indicated by research and recent news coverage.

CISA Alert and Initial Findings

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an alert over the weekend concerning the exploitation of a previously unknown flaw – a “zero-day” – within Microsoft’s SharePoint enterprise data management system.

While a conclusive assessment is still underway, preliminary evidence points to government organizations as the primary targets of the actors who initially began exploiting this vulnerability. This assessment comes from Silas Cutler, Principal Researcher at Censys, a firm specializing in internet hacking activity monitoring.

Targeting Specificity and Potential Expansion

“The initial exploitation appears to have been directed at a restricted set of targets,” Cutler stated to TechCrunch. “These targets were likely affiliated with governmental bodies.”

Cutler further noted, “This situation is developing quickly. The initial exploitation of this vulnerability was probably limited in scope regarding targeting. However, as more attackers learn to replicate the exploitation method, we anticipate further breaches resulting from this incident.”

Broader Exploitation Anticipated

With the vulnerability now publicly known and a complete patch from Microsoft still pending, it is plausible that additional malicious actors, not necessarily state-sponsored, will begin to exploit it, according to Cutler.

Vulnerable Instances and Compromises

Cutler and his team have identified between 9,000 and 10,000 SharePoint instances susceptible to this vulnerability that are accessible via the internet. This number is subject to change.

Eye Security, the organization that initially disclosed the vulnerability, reported similar findings. Their researchers scanned over 8,000 SharePoint servers globally and detected evidence of compromise on dozens of them.

Attribution to Advanced Persistent Threats

Considering the limited scope of initial targets and their nature, Cutler posits that the attackers were likely an advanced persistent threat (APT) group – a term commonly used to describe government-backed hacking operations.

Reported Targets

The Washington Post reported on Sunday that the attacks impacted U.S. federal and state agencies, as well as universities and energy sector companies, alongside other commercial entities.

Scope of the Vulnerability and Mitigation

Microsoft clarified in a blog post that the vulnerability affects only on-premises installations of SharePoint, not cloud-based versions. Consequently, organizations utilizing on-premises SharePoint servers must either apply the available patch or disconnect those servers from the internet.