CISA: Microsoft SharePoint flaw now exploited in ransomware attacks

Entities managing essential services face potential operational disruptions as the Gunra ransomware group expands its targeting of government agencies and hospitals. Operators are actively leveraging security gaps in software to infiltrate networks and escalate Ransomware-as-a-Service (RaaS) operations, with specific guidance issued advising against ransom payments for compromised Linux systems. Technical analysis identifies a widening attack surface involving critical infrastructure.

BleepingComputer reports that CISA has confirmed the exploitation of a Microsoft SharePoint flaw. Simultaneously, The Hacker News notes that the group is utilizing vulnerabilities within Fortinet and Schneider Electric hardware to facilitate initial network breaches. Investigations by the FBI and South Korean authorities are currently focused on the group's global activity.

Coverage does not yet specify the full scope of successful infiltrations or which specific organizations have confirmed data exfiltration following these network breaches.