Microsoft has issued an alert on “active attacks” to server software used by government agencies and companies to share documents within organizations and recommended that customers do security updates immediately.
The FBI said on Sunday that it is aware of the attacks and working closely with its federal and private sector partners, but has not offered further details.
In a warning issued on Saturday (19), he said it that vulnerabilities apply only to sharepoint servers used within organizations. The company said the Microsoft 365 sharepoint online, which is in the cloud, was not affected by attacks.
“We have closely coordinated with Cisa, the Defense Department’s cyber command command and the leading cyber security partners around the world throughout our response,” said a Microsoft spokesman, adding that the company had issued security updates and urgent customers immediately.
The Washington Post, which reported the attacks for the first time, said unidentified agents have explored a failure in recent days to launch an attack that targeted US agencies and companies.
The hack is known as the “day zero” attack because it targeted a hitherto unknown vulnerability, the newspaper said, citing experts. Tens of thousands of servers were at risk.
On the alert, Microsoft stated that a vulnerability “allows an authorized attacker to perform spoofing on a network.” The company has issued recommendations to prevent invaders from exploring it.
In a spoofing attack, an agent can manipulate financial markets or agencies hiding his identity and pretending to be a reliable person, organization or website.
Microsoft has previously reported that it is working on updates for SharePoint’s 2016 and 2019 versions. If customers are unable to enable recommended malware protection, they should disconnect their internet servers until a security update is available, he added.
