A recent cyber espionage operation exploited a zero-day vulnerability in Microsoft’s SharePoint software, compromising around 100 organizations.

Most victims are in the US and Germany, including several government entities.

The attack targeted self-hosted SharePoint servers, allowing hackers to install backdoors for ongoing access. Microsoft-hosted instances were not affected.

Microsoft issued a security alert on July 19, urging customers to apply updates.

The Shadowserver Foundation and Eye Security identified the victims before the exploit became widely known. Eye Security’s chief hacker, Vaisha Bernard, warned of possible additional breaches.

The affected organizations have not been named.

Recent Microsoft developments