Microsoft says some SharePoint server hackers now use ransomware

Straits Times

4 days ago

WASHINGTON - A cyber-espionage campaign centered on vulnerable versions of
Microsoft's server software now involves the deployment of ransomware, Microsoft said in a blog post on July 23.
In the post, citing 'expanded analysis and threat intelligence,' Microsoft said a group it dubs Storm-2603 is using the vulnerability to seed the ransomware, which typically works by paralysing victims' networks until a digital currency payment is made.
The disclosure marks a potential escalation in the campaign, which has already hit at least 400 victims, according to Netherlands-based cybersecurity firm Eye Security. Unlike typical state-backed hacker campaigns, which are aimed at stealing data, ransomware can cause widespread disruption depending on where it lands. The figure of 400 victims represents a sharp rise from the 100 organisations cataloged over the weekend. Eye Security says the figure is likely an undercount.
'There are many more, because not all attack vectors have left artifacts that we could scan for,' said Mr Vaisha Bernard, the chief hacker for Eye Security, which was among the first organisations to flag the breaches.
The details of most of the victim organisations have not yet been fully disclosed, but a representative for the National Institutes of Health confirmed on July 23 that one of the organisation's servers had been compromised.
'Additional servers were isolated as a precaution,' he said. The news of the compromise was first reported by the Washington Post. The spy campaign kicked off after Microsoft failed to fully patch a security hole in its SharePoint server software, kicking off a scramble to fix the vulnerability when it was discovered. Microsoft and its tech rival, Google owner Alphabet, have both said Chinese hackers are among those taking advantage of the flaw. Beijing has denied the claim. REUTERS