While the group is based in China, Microsoft previously said it is “unable to confidently assess the threat actor’s objectives.” The two other Chinese groups identified with the so-called “ToolShell” campaign — Linen Typhoon and Violet Typhoon — are confirmed state-backed actors known for more than a decade of espionage and intellectual property theft. A Cybersecurity and Infrastructure Security Agency (CISA) official told Recorded Future News that it is aware of federal agencies as well as state entities that may be affected by the campaign. Chinese hackers are exploiting a new vulnerability in Microsoft SharePoint products to deploy ransomware, increasing the pressure on governments around the world as they race to assess any damage done to their systems. The group began using ransomware during this campaign on July 18 and investigators saw the threat actors take a number of actions after gaining initial access — including disabling Microsoft Defender protections. The State Department told Recorded Future News that it is working with CISA and other federal agencies to investigate its exposure. CISA Acting Executive Assistant Director for Cybersecurity Chris Butera said they are working with Microsoft and other federal partners to address the ToolShell campaign. “The Department was minimally impacted due to its widespread use of the Microsoft M365 cloud and very capable cybersecurity systems,” the spokesperson said. In an update on Wednesday night, Microsoft said a China-based actor it identifies as Storm-2603 is now deploying Warlock ransomware after exploiting CVE-2025-49706. By Wednesday, the Washington Post obtained a letter saying the National Institutes of Health was breached through the vulnerability and NextGov reported that the Department of Homeland Security was impacted as well. Storm-2603 has no ties to the other Chinese state-backed groups Microsoft previously said were targeting unpatched on-premises SharePoint systems exposed to the internet. Recorded Future ransomware expert Allan Liska said the group behind Warlock is a ransomware-as-a-service operation with at least 11 victims so far. Netherlands-based cybersecurity firm Eye Security told Reuters and Bloomberg that hackers have successfully breached at least 400 governments and businesses around the world. Butera added that the Muli-State Information Sharing and Analysis Center (MS-ISAC) has been instrumental in helping them notify potentially impacted state and local partners. “We are still early in the incident response and we are continually assessing the scope and impact,” he told Recorded Future News.
This Cyber News was published on therecord.media. Publication date: Thu, 24 Jul 2025 16:05:19 +0000