Zero-Day Cyber Espionage Campaign Targets Microsoft SharePoint Servers A large-scale cyber espionage operation exploiting a previously unknown vulnerability in Microsoft’s self-hosted SharePoint servers has compromised nearly 100 organizations over the past weekend. The attack, classified as a zero-day exploit, allows threat actors to infiltrate vulnerable systems and deploy backdoors for persistent access. The campaign was uncovered by Netherlands-based cybersecurity firm Eye Security and the Shadowserver Foundation, which identified the breach on Friday before the exploit became widely known. An internet scan revealed that most victims were located in the United States and Germany, with government entities among those affected. While the exact identities of the compromised organizations remain undisclosed, authorities have been notified. Researchers suggest the attack may be the work of a single hacker or a coordinated group, though the scope could expand as the exploit gains wider attention. Microsoft released security updates on Saturday, urging customers to patch their systems. The FBI and Britain’s National Cyber Security Centre (NCSC) have acknowledged the attacks, with the NCSC reporting a "limited number" of UK targets. The potential reach of the campaign is significant over 8,000 SharePoint servers remain exposed online, including those belonging to industrial firms, financial institutions, healthcare providers, and government agencies. Security experts warn that simply applying the patch may not be sufficient, as attackers could have already established persistent access. As of now, the perpetrators behind the attack remain unidentified. Microsoft’s stock showed minimal movement following the disclosure, reflecting muted market reaction to the incident.