Microsoft says the Chinese threat actors Linen Typhoon, Violet Typhoon, and Storm-2603 have been exploiting the ToolShell zero-days.

A widespread cyberattack, attributed to Chinese state-sponsored hackers, compromised over 100 organizations globally, including the US National Nuclea

Microsoft has observed three China-based threat actors, Linen Typhoon, Violet Typhoon and Storm-2603, exploiting the SharePoint vulnerabilities

Microsoft is following up and is also releasing a patch for the 2016 edition of Sharepoint. Admins should install this immediately.

While all patches against ‘ToolShell’ exploits are now available for on-premises SharePoint Servers, attackers will be looking to utilize the vulnerabilities for months to come, security researchers tell CRN.

A new vulnerability dubbed ToolShell is being used to compromise on-premise instances of Microsoft SharePoint servers. Attacks have ranged from highly targeted to opportunistic based on the value of the company operating the server.