By James Pearson
LONDON, July 21 (Reuters)
Tech giant Microsoft is a noteworthy multinational company; it provides an extensive product range not only in hardware, but software. Their reach into cloud computing, gaming, and even AI has further expanded their influence. Their innovative approaches and technological advances really set them apart in the digital world. Workforce capabilities as of 2024 stood at a staggering 228,000 employees, with 120,000 based in the United States alone.
When a tech giant becomes vulnerable
A global attack on Microsoft MSFT.O server software used by thousands of government agencies and businesses to share documents within organizations is likely the work of a single actor, a cybersecurity researcher said on Monday. Microsoft on Saturday issued an alert about “active attacks” on SharePoint servers used within organizations. It said that SharePoint Online in Microsoft 365, which is in the cloud, was not hit by the exploit, also known as a “zero day,” because it was previously unknown to cybersecurity researchers.
The robust, collaborative SharePoint platform was designed with the purpose to help organizations to be able to manage their content, applications, and knowledge. These support cloud-based as well as on-premises deployments. This offers a whole range of flexibility for businesses of all shapes and sizes. And it seems that this is just the area that was targeted in these attacks.
Setting the compromising wheels in motion
“Based on the consistency of the tradecraft seen across observed attacks, the campaign launched on Friday appears to be a single actor. However, it’s possible that this will quickly change,” Rafe Pilling, Director of Threat Intelligence at Sophos, a British cybersecurity firm.
That tradecraft included the sending of the same digital payload to multiple targets, Pilling added. Microsoft said it had “provided security updates and encourages customers to install them,” a company spokesperson said in an emailed statement. It was not clear who was behind the ongoing hack.
The FBI said on Sunday it was aware of the attacks and was working closely with its federal and private-sector partners, but offered no other details. Britain’s National Cyber Security Centre did not immediately respond to a request for comment. The Washington Post said unidentified actors in the past few days had exploited a flaw to launch an attack that targeted U.S. and international agencies and businesses.
A small step for a problem with a global outreach
According to data from Shodan, a search engine that helps to identify internet-linked equipment, over 8,000 servers online could theoretically have already been compromised by hackers. Those servers include major industrial firms, banks, auditors, healthcare companies, and several U.S. state-level and international government entities.
“The SharePoint incident appears to have created a broad level of compromise across a range of servers globally,” said Daniel Card of British cybersecurity consultancy, PwnDefend. “Taking an assumed breach approach is wise, and it’s also important to understand that just applying the patch isn’t all that is required here.”
This type and other such vulnerabilities are very worrying. SharePoint servers usually connect to other Microsoft services, such as Teams, Outlook, etc. Experiencing a breach in this field can quickly escalate badly. Not only password harvesting, but also data theft, is one of the things that quickly spring to mind when some unwanted person has access to personal information.
This situation has once again laid the focus on security risks and threats that circulate within the digital world. For almost every organization across the globe, data is the core factor that runs through their company. Having someone leisurely browse through and pick out related information can have serious consequences. Apart from what is mentioned above, the company’s reputation will also take a knock. That said, one seemingly small action can lead to an even bigger problem.
GCN.com/REUTERS.
