A China-based hacking group is deploying Warlock ransomware on Microsoft SharePoint servers vulnerable to widespread attacks targeting the recently patched ToolShell zero-day exploit chain.

If exploited, attackers can gain full access to SharePoint content and potentially pivot to Outlook, Teams, and OneDrive. Learn how to protect your SharePoint server from compromise.

More information has emerged on the ToolShell SharePoint zero-day attacks, including impact, victims, and threat actors.

Microsoft has observed three China-based threat actors, Linen Typhoon, Violet Typhoon and Storm-2603, exploiting the SharePoint vulnerabilities

ESET Research has been monitoring intense attacks involving the recently discovered ToolShell zero-day vulnerabilities.

More details emerged on the ToolShell zero-day attacks targeting SharePoint servers, but confusion remains over the vulnerabilities.

Microsoft released a patch Monday for SharePoint Server 2016 that protects customers against a pair of vulnerabilities, which have been widely exploited in a wave of cyberattacks known as “ToolShell.”

The name was coined by Dinh Ho Anh, a researcher from Khoa of Viettel Cyber Security, who developed the exploit. The researcher said he picked the name because it exploited ToolPane.aspx, a component for assembling the side panel view in the SharePoint user interface.

Hackers with ties to the Chinese government have been linked to a recent wave of widespread attacks targeting a Microsoft SharePoint zero-day vulnerability chain.

An ongoing cyberattack campaign known as “ToolShell” is exploiting on-premises Microsoft SharePoint Servers and has reportedly compromised organizations worldwide.

The ToolShell bugs are being exploited by cybercriminals and APT groups alike, with the US on the receiving end of 13 percent of all attacks.

A security patch released by Microsoft earlier this month failed to fully fix a critical flaw in the U.S. tech company's SharePoint server software that had been identified at a hacking competition in May,