Blame a leak for Microsoft SharePoint attacks, researcher insists
- Reference: 1753529290
- News link: https://www.theregister.co.uk/2025/07/26/microsoft_sharepoint_attacks_leak/
- Source link:
How did the attackers, who include Chinese government spies, data thieves, and ransomware operators, know how to exploit the SharePoint CVEs in such a way that would bypass the security fixes Microsoft released the following day?
"A leak happened here somewhere," Dustin Childs, head of threat awareness at Trend Micro's Zero Day Initiative (ZDI), told The Register . "And now you've got a zero-day exploit in the wild, and worse than that, you've got a zero-day exploit in the wild that bypasses the patch, which came out the next day."
Countdown to mass exploitation
It all began back in May, on stage at the Pwn2Own competition.
Pwn2Own is the hackers' equivalent of the World Series, and ZDI usually hosts these competitions twice a year.
[1]
The most recent contest occurred in Berlin, beginning May 15. On [2]day 2 of the event, Vietnamese researcher Dinh Ho Anh Khoa combined an auth bypass and an insecure deserialization bug to exploit Microsoft SharePoint and win $100,000.
[3]
[4]
"What happens on the stage is just one part of Pwn2Own," Childs said.
After demonstrating a successful exploit, the bug hunter and vendor are whisked away into a private room where the researcher explains what they did and provides the technology company with a full write-up of the exploit. Assuming it's not a duplicate or already known vulnerability, the vendor then has 90 days to issue a fix before the bug and exploit are made public.
[5]
"So Microsoft received the working exploit in a white paper describing everything on that day," Childs said.
Less than two months later, on July 8, the software giant disclosed the two CVEs – CVE-2025-49704, which allows unauthenticated remote code execution, and CVE-2025-49706, a spoofing bug – and released software updates intended to patch the flaws. But [6]mass exploitation had already started the day before, on July 7.
"Sixty days to fix really isn't a bad timeline for a bug that stays private and stays under coordinated disclosure rules," Childs said. "What is bad: a leak happened."
[7]
There's another key date that may shed light on when that leak happened.
Patch Tuesday happens the second Tuesday of every month – in July, [8]that was the 8th . But two weeks before then, Microsoft provides early access to some security vendors via the Microsoft Active Protections Program (MAPP).
These vendors are required to sign a non-disclosure agreement about the soon-to-be-disclosed bugs, and Microsoft gives them early access to the vulnerability information so that they can provide updated protections to customers faster.
"The first MAPP drop occurs at what we call r minus 14, which is two weeks ahead of the [Patch Tuesday] release," Childs said – that is, beginning on June 24. "Then, on July 7, we started to see attacks. July 8, the patches were out and were almost immediately bypassed."
ZDI, along with other security providers, poked holes in the initial patches and determined that the authentication bypass piece was too narrow, and attackers could easily bypass this fix. In fact, anyone who received the early MAPP information about the CVEs and software updates "would be able to tell that this is an easy way to get past it," Childs said.
On July 18, Eye Security first [9]sounded the alarm on "large-scale exploitation of a new SharePoint remote code execution (RCE) vulnerability chain in the wild."
A day later, Microsoft warned SharePoint server users that three on-prem versions of the product included a zero-day flaw that was under attack – and that its own failure to completely patch the holes was to blame.
[10]Microsoft: SharePoint attacks now officially include ransomware infections
[11]Microsoft SharePoint victim count hits 400+ orgs in ongoing attacks
[12]Surprise, surprise: Chinese spies, IP stealers, other miscreants attacking Microsoft SharePoint servers
[13]Another massive security snafu hits Microsoft, but don't expect it to stick
By July 21, Redmond had [14]issued software updates for all three versions. But by then, [15]more than 400 organizations had been compromised by at least two Chinese state-sponsored crews, [16]Linen Typhoon and Violet Typhoon , plus a gang Microsoft tracks as Storm-2603, which was abusing the vulnerabilities to [17]deploy ransomware .
Microsoft declined to answer The Register 's specific questions for this story. "As part of our standard process, we'll review this incident, find areas to improve, and apply those improvements broadly," a Microsoft spokesperson said in an emailed statement.
One researcher suggests a leak may not have been the only pathway to exploit. " [18]Soroush Dalili was able to use Google's Gemini to help reproduce the exploit chain, so it's possible the threat actors did their own due diligence, or did something similar to Dalili, working with one of the frontier large language models like Google Gemini, o3 from OpenAI, or Claude Opus, or some other LLM, to help identify routes of exploitation," Tenable Research Special Operations team senior engineer Satnam Narang told The Register .
"It's difficult to say what domino had to fall in order for these threat actors to be able to leverage these flaws in the wild," Narang added.
Nonetheless, Microsoft did not release any MAPP guidance for the two most recent vulnerabilities, [19]CVE-2025-53770 and [20]CVE-2025-53771 , which are related to the previously disclosed CVE-2025-49704 and CVE-2025-49706.
"It could mean that they no longer consider MAPP to be a trusted resource, so they're not providing any information whatsoever," Childs speculated. "It also could mean that they're scrambling so much to work on the fixes they don't have time to notify their partners of these other details."
"It could just be a logistical resource issue, or it could be, hey, I don't trust MAPP right now, we're not telling them anything, which is what I would do in their situation," he continued. "If I thought a leak came from this channel, I would not be telling that channel anything." ®
Get our [21]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aIZNJyyOs7CxP-czG1HKFwAAANI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://www.zerodayinitiative.com/blog/2025/5/16/pwn2own-berlin-2025-day-two-results
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aIZNJyyOs7CxP-czG1HKFwAAANI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aIZNJyyOs7CxP-czG1HKFwAAANI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aIZNJyyOs7CxP-czG1HKFwAAANI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aIZNJyyOs7CxP-czG1HKFwAAANI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2025/07/08/microsoft_patch_tuesday/
[9] https://research.eye.security/sharepoint-under-siege/
[10] https://www.theregister.com/2025/07/24/microsoft_sharepoint_ransomware/
[11] https://www.theregister.com/2025/07/23/microsoft_sharepoint_400_orgs/
[12] https://www.theregister.com/2025/07/22/chinese_groups_attacking_microsoft_sharepoint/
[13] https://www.theregister.com/2025/07/21/massive_security_snafu_microsoft/
[14] https://www.theregister.com/2025/07/22/microsoft_sharepoint_2016_patch/
[15] https://www.theregister.com/2025/07/23/microsoft_sharepoint_400_orgs/
[16] https://www.theregister.com/2025/07/22/chinese_groups_attacking_microsoft_sharepoint/
[17] https://www.theregister.com/2025/07/24/microsoft_sharepoint_ransomware/
[18] https://x.com/irsdl/status/1946166765316161634
[19] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770
[20] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53771
[21] https://whitepapers.theregister.com/
My guess is as soon as the exploit was leaked, the clock started ticking and they knew they had 2 weeks to successfuly weaponise, deploy and launch attacks containing the exploit. They only just made it in time; I probably would have missed the deadline.
Responsible disclosure done wrong… every time
Rather than hiding things, a lot of the real world damage could have been prevented had Microsoft disclosed to everyone (from the outset of finding out about the problem) that they urgently needed to hide their private corporate SharePoint instances behind some proper additional Kerberos authentication at the web server level or use a decent reverse proxy, VPN, IPSec or another mitigation designed to prevent untrusted entities from interacting with it in the first place, until a fix could be issued. Instead they left it a bit late, only sounding the alarm long after they’d ensured their overpriced cloud instances were safe, and did a piss poor job with messaging until their initial attempt at a patch was botched.
This isn’t the only time they’ve dropped the ball either, just on file sharing solutions alone. For instance, Microsoft never made SMB truly Internet safe, and for years dithered on the messaging about SMB security and how appropriate it is to use outside of a tightly controlled environment. If a protocol isn’t Internet safe, it isn’t really network safe in general, but Microsoft never wanted to make that clear until they had a [paid] solution ready. Many, many systems were compromised as a result of SMB exploits in the early days, to the point where ISPs had to block Port 445 on behalf of their subscribers. But even more recently we saw major compromises on internal networks (the UK NHS ransomware attacks being a big example of this). Microsoft eventually fixed the SMB Internet safety problem by implementing a glorified SSL proxy over the top (SMB-over-QUIC) but only made it available on their cloud at first (specifically in Server 2022 Azure Edition) before finally making people buy a whole new OS (Server 2025) if they wanted to have the same security on-prem.
I say this as someone who earns a living maintaining Microsoft products: You will keep having this same issue over and over again, and you will keep paying people like me to maintain these terrible products, even when there are far better options out there.
Nice Sharepoint you have on premises....
.... it would be bad if something happened to it. Look at my Azure offer... it is not vulnerable...
If I were Congress - I would grill Nadella immediately. But probably he paid Trump enough to avoid it.
Leaky leak
The cybersecurity world acts baffled every time a patch leaks before release, as if we don’t live in an economy built on disposable labour and institutional distrust. The truth is simpler and more uncomfortable: when corporations hollow themselves out in pursuit of margin, they also hollow out their defences.
It’s not just Microsoft. It’s the entire model. Lay off half your security team to boost your share price, outsource critical work to the lowest bidder, funnel resources into C-suite bonuses and stock buybacks, and then wring your hands when someone in the system decides loyalty isn’t worth a cold lunch and a hot desk.
Employees are told to return to soulless offices while senior management dials in from the Maldives. The car park has luxury SUVs, while junior staff are choosing between topping up their heating or making rent. Promotions are frozen. Pay rises are laughable. And the cost of basic dignity - owning a home, starting a family - is pushed further out of reach each year.
In this environment, leaks aren’t anomalies. They’re pressure valves. All it takes is one disillusioned insider with a conscience dulled by corporate hypocrisy and an envelope waved by someone promising to make their life a little less grim. Not out of malice. Just weariness.
If you build your entire operation on mistrust, underpayment, and performative ethics, you shouldn’t be surprised when the real vulnerabilities aren’t in the code - they’re in the culture.
Just thinking about the timing. If they suspect a leak two weeks before public release on the 8th why did the attacks only start on the 7th? Did it take that long for the leak to work through?
I'm not familiar with the way these things are due but are the PT releases simultaneous world-wide ot locally timed because there a places in the world where it's July 8th while at other places it's still july 7th?