Initial access in these intrusions was achieved by leveraging flaws in SharePoint, which the group used as an entry point before moving deeper into the affected networks. The targeting of critical infrastructure and public-sector organizations underscores the broad operational scope of the group rather than a focus on a single industry vertical.

Reported victims span multiple sectors:

• A water utility
• A telecom operator
• A regional government body
• A university

Organizations running on-premises SharePoint deployments should prioritize patching and review exposure of their instances, given that this attack vector is being actively used for initial access. Limiting internet-facing exposure and monitoring for suspicious activity tied to the collaboration platform are sensible defensive steps while remediation is underway. No specific CVE identifiers were provided in the source report, so defenders should consult vendor guidance for the latest SharePoint security updates affecting their deployed versions.

Source: BleepingComputer

Has your organization reviewed its internet-facing SharePoint instances for exposure to this threat?