Microsoft says China-based threat actors behind SharePoint attacks 

Microsoft July 22 released an update on the ongoing cyberattacks to SharePoint servers used within organizations, attributing the incidents to China-based threat actors. The company said the attacks include state-sponsored actors from the Linen Typhoon and Violet Typhoon groups, as well as China-based actor Storm-2603. The attacks have not impacted SharePoint Online in Microsoft 365. 

The new announcement includes updated indicators of compromise and clarified mitigation and protection guidance. 

The AHA July 21 released an advisory with additional information on the attacks. 

For more information on this or other cyber and risk issues, contact Scott Gee, AHA deputy national advisor of cybersecurity and risk, at sgee@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.