Microsoft confirms SharePoint vulnerabilities have been exploited by suspected Chinese hackers, as reports indicate the US Nuclear Security Administration may have been among those compromised

A logo marking the edge of the Microsoft corporate campus in Redmond, Washington.

Following on from Microsoft's warning earlier this week that "active attacks" were targeting its SharePoint Server customers through a known exploit, the company has now released a blog post revealing more details about the breach. According to MS, on-premises SharePoint servers were determined to have been attacked by three allegedly Chinese nation-state actors, Linen Typhoon, Violet Typhoon, and Storm-2603, via a known spoofing vulnerability and a remote code execution vulnerability.

Reuters reported on Monday that, according to Vaisha Bernard, chief hacker at Eye Security, around 100 organisations were compromised as of the weekend. The Shadowserver Foundation said that most of those affected were in the United States and Germany, and the victims included government organisations.