Critical SharePoint Zero-Day Exploit: Stealing Keys and Maintaining Persistent Access Since July 7

TL;DR

A critical Microsoft SharePoint vulnerability has been actively exploited since July 7, 2025, targeting major Western governments and other sectors. The exploits allow hackers to steal encryption keys and maintain persistent access. This underscores the need for vigilant cybersecurity measures and timely patching of vulnerabilities.

Critical SharePoint Zero-Day Exploit Uncovered

On July 7, 2025, a critical Microsoft SharePoint vulnerability was discovered to be under active exploitation, according to findings from Check Point Research. This zero-day vulnerability has been targeted by cybercriminals, with initial attempts observed against an unnamed major Western government. The activity intensified significantly on July 18 and 19, expanding to include governmental, telecommunications, and software sectors.

Exploitation Details

The exploitation attempts involved sophisticated techniques aimed at stealing encryption keys and maintaining long-term access to compromised systems. This level of persistence indicates a well-coordinated effort by the attackers to infiltrate and control critical infrastructure.

Sectors Affected

• Government: Initial targets included a major Western government, highlighting the potential for significant data breaches and national security risks.
• Telecommunications: The telecommunications sector was also targeted, raising concerns about the integrity of communications infrastructure.
• Software: Software companies were affected, posing risks to intellectual property and sensitive data.

Implications and Mitigation

The ongoing exploitation of this SharePoint vulnerability underscores the importance of proactive cybersecurity measures. Organizations must prioritize timely patching of vulnerabilities and implement robust security protocols to safeguard against such threats.

Recommendations

• Patch Management: Ensure all systems are up-to-date with the latest security patches.
• Monitoring: Implement continuous monitoring to detect and respond to suspicious activities.
• Access Control: Enforce strict access controls to limit potential entry points for attackers.

Conclusion

The exploitation of the SharePoint zero-day vulnerability serves as a stark reminder of the ever-present threats in the cybersecurity landscape. Organizations must remain vigilant and proactive in their security measures to protect against such sophisticated attacks.

For more details, visit the full article: source