SHAREPOINT RCE CHAIN UNDER ACTIVE ATTACK

Security researchers at Defused identified threat actors actively targeting two chained Microsoft SharePoint vulnerabilities that allow remote code execution on vulnerable installations. The attack sequence enables attackers to compromise servers running unpatched versions of SharePoint. Proof-of-concept exploits are now circulating, lowering the barrier to entry for additional threat actors. Microsoft has not yet disclosed patch timelines for the vulnerabilities. Organizations running SharePoint deployments should prioritize threat assessment and implement network segmentation to limit lateral movement if compromise occurs. This follows recent attacks using TerminalFix, a new variant of ClickFix malware that deploys reverse tunnels through fake Cloudflare CAPTCHA prompts on compromised websites, tricking users into executing malicious PowerShell commands. Defused recommends monitoring for unauthorized SharePoint access and reviewing logs for suspicious command execution activity.