A China-linked threat actor has been observed exploiting SharePoint servers to deliver ransomware, according to Microsoft researchers, in the latest sign of worsening attacks against on-premises SharePoint Server customers.

A July 8 fix for a critical SharePoint zero-day failed to stop active exploitation, enabling state-backed attackers to breach nearly 100 organizations worldwide.

Microsoft July 22 released an update on the ongoing cyberattacks to SharePoint servers used within organizations, attributing the incidents to China-based threat actors.

The move comes after a ProPublica report highlighted a Microsoft program that allows foreign engineers to indirectly interact with U.S. military systems through American “escort” intermediaries.

After a ProPublica investigation raised security concerns, Microsoft will cease using China-based engineers for work on sensitive Pentagon cloud computing systems.

Following criticism of the company’s use of Chinese workers to advise on operation of Department of Defense cloud systems, Microsoft has changed its policy.

Technicians from China took care of the Department of Defense's cloud on behalf of Microsoft. After this came to light, the provider had to rebuild.