Massive Cyber-Espionage Attack Targets Nearly 400 Organizations via Microsoft SharePoint Exploit

A recent report by Reuters reveals a devastating cyber-espionage campaign exploiting a zero-day vulnerability in Microsoft SharePoint servers, impacting close to 400 organizations globally. The attack, discovered by Dutch cybersecurity firm Eye Security, is primarily targeting government, healthcare, finance, education, and manufacturing sectors. While initial reports suggested around 100 victims, researchers now believe the true scale of the attack may be far larger.

The breach centers around a critical vulnerability in Microsoft SharePoint, known as CVE-2025‑53770 and CVE‑2025‑53771. These unpatched flaws allow cybercriminals to take complete control of affected servers, steal cryptographic keys, install persistent backdoors, and maintain access even after patches are applied. Despite efforts to address the issue, hundreds of SharePoint servers remain exposed globally.

the Situation

Researchers at Eye Security first detected this cyberattack on July 18 when scans revealed dozens of compromised systems worldwide, using the same malicious payload. Their initial findings indicated roughly 100 victim organizations, but as they expanded their scans, the number quickly grew to nearly 400. These findings were based on digital traces left behind on exposed servers, which is just a fraction of the total damage caused.

Vaisha Bernard, chief hacker at Eye Security, noted that not all attack methods leave traces, suggesting that the real number of affected organizations is likely much higher. Microsoft, upon confirmation of the vulnerability, rushed to release emergency patches and guidance, but the attack has already escalated. While the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities list, the full impact remains uncertain, especially for those still using outdated versions of SharePoint.

What Undercode Says: Analyzing the Broader Implications

This attack highlights a critical vulnerability in widely used enterprise software. SharePoint, a platform relied upon by government agencies, healthcare organizations, and private corporations alike, now finds itself at the center of a massive global breach. The fact that the vulnerability allows attackers to maintain long-term access by installing backdoors raises serious concerns about long-term security risks.

One of the most concerning aspects of this attack is the speed at which it spread. In just a matter of days, Eye Security researchers identified hundreds of compromised systems across multiple sectors, emphasizing the importance of rapid patching and proactive monitoring. However, the difficulty in detecting these attacks, as highlighted by Bernard, points to an alarming reality: many organizations are unaware they have been breached, or may not even be aware that their servers are vulnerable.

The shift from “100” to “400” victims within days indicates that organizations are not just reactive to cybersecurity threats—they’re often far behind in understanding the scope of an attack. Many businesses, especially smaller ones, may be unaware of the risk they face from such exploits unless they have specialized cybersecurity teams or proactive monitoring systems.

Fact Checker Results:

✅ Vulnerability Confirmed: Microsoft has confirmed the zero-day vulnerability in SharePoint, and patches have been released to mitigate the risk.

❌ Vast Underreporting: The true scale of the attack is much larger than currently reported, as many organizations may not detect or report their compromised servers.

✅ CISA Mandates Action: The U.S. Cybersecurity and Infrastructure Security Agency has added the vulnerability to its Known Exploited Vulnerabilities list, requiring immediate remediation by federal agencies.

Prediction: What Lies Ahead for Microsoft SharePoint Servers

With the rapid escalation of the attack, it is likely that the number of victims will continue to rise. As researchers noted, many of the exploited SharePoint servers remain unpatched, leaving businesses at risk. Additionally, the exploit is likely to evolve—cybercriminals may start targeting other vulnerable systems using similar tactics, broadening the scope of the campaign.

It’s crucial for organizations to be proactive in securing their servers by applying patches, upgrading legacy systems, and continuously monitoring their infrastructure for unusual activity. Those that fail to take immediate action could face prolonged disruptions, data breaches, and potential legal liabilities.