Urgent: Chinese Hackers Are Hitting SharePoint Servers with Ransomware (Here's What's Happening)

I don't usually hit the panic button, but this SharePoint situation is pretty serious. Microsoft just confirmed that Chinese hackers are actively breaking into SharePoint servers worldwide, and they're dropping ransomware once they get in. What makes this extra concerning? They're targeting some incredibly sensitive places, including U.S. nuclear facilities.

What's Actually Happening Here?

The attack group (known as Storm-2603) is exploiting two major security holes in SharePoint (CVE-2025-49706 and CVE-2025-49704). Once they're in, they're deploying something called Warlock ransomware, which basically locks down everything on the server until you pay up.

Think of it like finding out there's a master key that opens thousands of office buildings, and a group of professional thieves just got their hands on it. Except in this case, they're not just breaking in - they're locking everyone else out and demanding money to let them back in.

How Bad Is This Really?

Pretty bad. Here's what we know:

Thousands of SharePoint servers are vulnerable right now
The U.S. nuclear weapons agency was targeted (yes, you read that right)
Multiple government networks have already been hit
The attacks are spreading globally

Protecting Your SharePoint Server

If you're running SharePoint, here's what you need to do immediately:

Update your SharePoint installation RIGHT NOW with the latest security patches
Check Microsoft's security advisory for specific mitigation steps
Run a full system scan to check for any signs of compromise
Back up your data immediately (if you haven't already)

For enterprise networks, this is exactly why you want network monitoring and endpoint protection in place. I've been recommending Malwarebytes Premium to my business clients for years - it's particularly good at catching ransomware before it can do damage.

Broader Security Measures You Should Take

While you're updating SharePoint, now's a good time to shore up your overall network security:

Use a business-grade VPN to encrypt all remote access connections (I've set up NordVPN for several small businesses - it's reliable and their business plan includes dedicated IP addresses)
Implement strong access controls and multi-factor authentication
Regularly backup critical data offsite
Train your staff on security awareness - especially around ransomware

What If You've Already Been Hit?

If you suspect you've been compromised:

Immediately disconnect the affected servers from your network
Contact your cybersecurity team or IT provider
Report the incident to CISA (if you're in the US)
Do NOT pay the ransom without consulting security experts first

Look, I know software updates are annoying. But this isn't one of those "I'll do it later" situations. These attackers are actively hunting for vulnerable SharePoint servers right now, and they're not being picky about their targets. The few minutes of downtime for updates is nothing compared to the weeks of chaos ransomware can cause.

Quick heads up:Some links in this article are affiliate links. If you buy something through them, we might earn a small commission (doesn't cost you extra). We only recommend stuff we'd actually use ourselves or set up for our own families. No BS recommendations here.