Microsoft SharePoint vulnerability allows hackers to sift through servers, Saudi authorities warn

The attacks are an example of how a file-sharing service can be abused to gather valuable information on a target.

Hackers are exploiting a remote code execution vulnerability in Microsoft SharePoint to conduct reconnaissance on the networks of target organizations, a Saudi government cybersecurity agency said Thursday.

In activity that private-sector researchers are also tracking, the unnamed hackers are gathering information on Microsoft Exchange and SQL servers in a sign “the attack is still in its first stages,” Saudi Arabia’s National Cybersecurity Authority (NCA) said in an advisory. The alert did not offer further information on the victims.

The attacks are an example of how a file-sharing service can be abused to gather valuable information on a target. The vulnerability applies to older versions of SharePoint, an application organizations use to share and store documents. With a foothold on a network, the attackers have deployed a web shell script that can be used to manipulate data on a server, according to the NCA.

The Saudi agency “observed a spike in scanning activities on this specific vulnerability,” indicating “quick adoption from multiple threat actors” keen on exploiting the remote network access, said the advisory, which details a new custom backdoor used by attackers.

“The attackers in the Saudi case are reasonably capable,” said Chris Doman, a security researcher at AT&T Alien Labs who has tracked the intrusions. “The malware waits for encrypted commands from an attacker — rather than noisily reaching out to an attacker’s command and control server.”

The advisory follows an alert last month from the Canadian government’s Centre for Cyber Security saying the SharePoint vulnerability likely had been used to breach organizations in the academic, manufacturing, utility, “heavy industry,” and tech sectors. The advisory did not say where the victim organizations were located.

Microsoft has issued a patch for the flaw, but that is only as good as its application by vulnerable organizations. The NCA said multiple organizations had been infected by the exploit in the last two weeks.

Despite the reports of infections in multiple sectors, the SharePoint vulnerability isn’t being as widely exploited as other server-side flaws like the one in Oracle WebLogic, Doman told CyberScoop. AT&T Alien Labs has analyzed an earlier version of the malware used in breaching Saudi organizations.

“The naming of the domains in the Saudi intrusions seem to indicate some particular targeting,” Doman said. He pointed to the fact that the attackers had impersonated a Saudi government website promoting the Kingdom’s strategic policies.

The hackers “haven’t left any obvious indicators of their location in the malware or servers,” Doman said.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure