US nuke agency hacked

Attacks spur scrutiny of Microsoft security

- JAKE BLEIBERG ARI NATTER RYAN GALLAGHER

Microsoft Corp warned that Chinese state-sponsored hackers are among those exploiting flaws in its SharePoint software to break into institutions globally, with the US agency responsible for designing nuclear weapons now among those breached.

In a blog post, the tech giant identified two groups supported by the Chinese government, Linen Typhoon and Violet Typhoon, as leveraging flaws in the document-sharing software that rendered customers who run it on their own networks, as opposed to in the cloud, vulnerable. Another hacking group based in China, which Microsoft calls Storm-2603, also exploited them, according to the blog.

The number of companies and agencies subjected to breaches as a result of these exploits is meanwhile mounting: Hackers have used the SharePoint flaws to break into the US National Nuclear Security Administration, according to a person with knowledge of the matter who wasn't authorised to speak publicly. Bloomberg also reported Monday that systems belonging to the US Education Department, Florida's Department of Revenue and the Island General Assembly were compromised.

While Microsoft has patched its software in recent days, cybersecurity researchers have already detected breaches on more than 100 servers representing 60 victims thus far, including organisations in the energy sector, consulting firms and universities. Hackers have also exploited the software to break into the systems of national governments from Europe to the Middle East, according to a person familiar with the matter.

The SharePoint flaws have been used in hacks since at least July 7, said Adam Meyers, senior vice president at CrowdStrike Holdings Inc. Early exploitation resembled government-sponsored activity and then spread more widely to include hacking that "looks like China," Mr Meyers said. CrowdStrike's investigation into the campaign is ongoing, he said.

'HIGH-SEVERITY THREAT'