South African Planning Agency Compromised in SharePoint Hack Attack

Hackers have targeted the South African Department of Planning, Monitoring and Evaluation, exploiting a vulnerability in Microsoft's SharePoint servers. The department has implemented countermeasures, including software patches from Microsoft. The attacks have affected over 400 government agencies, corporations, and other groups globally, with most victims in the US, Mauritius, Jordan, South Africa, and the Netherlands. Microsoft warned of attacks targeting on-premise SharePoint networks, which is popular in South Africa for document storage and collaboration.

Hackers have targeted the South African Department of Planning, Monitoring and Evaluation, exploiting a vulnerability in Microsoft's SharePoint servers. The department has implemented countermeasures, including software patches from Microsoft. The attacks have affected over 400 government agencies, corporations, and other groups globally, with most victims in the US, Mauritius, Jordan, South Africa, and the Netherlands. Microsoft warned of attacks targeting on-premise SharePoint networks, which is popular in South Africa for document storage and collaboration [1].

The vulnerability, known as ToolShell, was discovered in May 2025 during the Pwn2Own Berlin competition. It allows attackers to remotely execute arbitrary code on vulnerable SharePoint servers. Microsoft released a patch in June, but the vulnerability was exploited before all organizations could apply it. The attacks have been attributed to opportunistic threat actors who target any Internet-exposed SharePoint server [1].

The South African Department of Planning, Monitoring and Evaluation was one of the victims. The department reported that it had implemented countermeasures, including software patches from Microsoft. However, the attacks have affected over 400 government agencies, corporations, and other groups globally. Most victims are in the US, Mauritius, Jordan, South Africa, and the Netherlands [1].

The attacks have been attributed to opportunistic threat actors who target any Internet-exposed SharePoint server. The vulnerability, known as ToolShell, was discovered in May 2025 during the Pwn2Own Berlin competition. It allows attackers to remotely execute arbitrary code on vulnerable SharePoint servers. Microsoft released a patch in June, but the vulnerability was exploited before all organizations could apply it [1].

The attacks have been attributed to opportunistic threat actors who target any Internet-exposed SharePoint server. The vulnerability, known as ToolShell, was discovered in May 2025 during the Pwn2Own Berlin competition. It allows attackers to remotely execute arbitrary code on vulnerable SharePoint servers. Microsoft released a patch in June, but the vulnerability was exploited before all organizations could apply it [1].

The attacks have been attributed to opportunistic threat actors who target any Internet-exposed SharePoint server. The vulnerability, known as ToolShell, was discovered in May 2025 during the Pwn2Own Berlin competition. It allows attackers to remotely execute arbitrary code on vulnerable SharePoint servers. Microsoft released a patch in June, but the vulnerability was exploited before all organizations could apply it [1].

The attacks have been attributed to opportunistic threat actors who target any Internet-exposed SharePoint server. The vulnerability, known as ToolShell, was discovered in May 2025 during the Pwn2Own Berlin competition. It allows attackers to remotely execute arbitrary code on vulnerable SharePoint servers. Microsoft released a patch in June, but the vulnerability was exploited before all organizations could apply it [1].

The attacks have been attributed to opportunistic threat actors who target any Internet-exposed SharePoint server. The vulnerability, known as ToolShell, was discovered in May 2025 during the Pwn2Own Berlin competition. It allows attackers to remotely execute arbitrary code on vulnerable SharePoint servers. Microsoft released a patch in June, but the vulnerability was exploited before all organizations could apply it [1].

The attacks have been attributed to opportunistic threat actors who target any Internet-exposed SharePoint server. The vulnerability, known as ToolShell, was discovered in May 2025 during the Pwn2Own Berlin competition. It allows attackers to remotely execute arbitrary code on vulnerable SharePoint servers. Microsoft released a patch in June, but the vulnerability was exploited before all organizations could apply it [1].

The attacks have been attributed to opportunistic threat actors who target any Internet-exposed SharePoint server. The vulnerability, known as ToolShell, was discovered in May 2025 during the Pwn2Own Berlin competition. It allows attackers to remotely execute arbitrary code on vulnerable SharePoint servers. Microsoft released a patch in June, but the vulnerability was exploited before all organizations could apply it [1].

The attacks have been attributed to opportunistic threat actors who target any Internet-exposed SharePoint server. The vulnerability, known as ToolShell, was discovered in May 2025 during the Pwn2Own Berlin competition. It allows attackers to remotely execute arbitrary code on vulnerable SharePoint servers. Microsoft released a patch in June, but the vulnerability was exploited before all organizations could apply it [1].

The attacks have been attributed to opportunistic threat actors who target any Internet-exposed SharePoint server. The vulnerability, known as ToolShell, was discovered in May 2025 during the Pwn2Own Berlin competition. It allows attackers to remotely execute arbitrary code on vulnerable SharePoint servers. Microsoft released a patch in June, but the vulnerability was exploited before all organizations could apply it [1].

The attacks have been attributed to opportunistic threat actors who target any Internet-exposed SharePoint server. The vulnerability, known as ToolShell, was discovered in May 2025 during the Pwn2Own Berlin competition. It allows attackers to remotely execute arbitrary code on vulnerable SharePoint servers. Microsoft released a patch in June, but the vulnerability was exploited before all organizations could apply it [1].

The attacks have been attributed to opportunistic threat actors who target any Internet-exposed SharePoint server. The vulnerability, known as ToolShell, was discovered in May 2025 during the Pwn2Own Berlin competition. It allows attackers to remotely execute arbitrary code on vulnerable SharePoint servers. Microsoft released a patch in June, but the vulnerability was exploited before all organizations could apply it [1].

The attacks have been attributed to opportunistic threat actors who target any Internet-exposed SharePoint server. The vulnerability, known as ToolShell, was discovered in May 2025 during the Pwn2Own Berlin competition. It allows attackers to remotely execute arbitrary code on vulnerable SharePoint servers. Microsoft released a patch in June, but the vulnerability was exploited before all organizations could apply it [1].

The attacks have been attributed to opportunistic threat actors who target any Internet-exposed SharePoint server. The vulnerability, known as ToolShell, was discovered in May 2025 during the Pwn2Own Berlin competition. It allows attackers to remotely execute arbitrary code on vulnerable SharePoint servers. Microsoft released a patch in June, but the vulnerability was exploited before all organizations could apply it [1].

The attacks have been attributed to opportunistic threat actors who target any Internet-exposed SharePoint server. The vulnerability, known as ToolShell, was discovered in May 2025 during the Pwn2Own Berlin competition. It allows attackers to remotely execute arbitrary code on vulnerable SharePoint servers. Microsoft released a patch in June, but the vulnerability was exploited before all organizations could apply it [1].

The attacks have been attributed to opportunistic threat actors who target any Internet-exposed SharePoint server. The vulnerability, known as ToolShell, was discovered in May 2025 during the Pwn2Own Berlin competition. It allows attackers to remotely execute arbitrary code on vulnerable SharePoint servers. Microsoft released a patch in June, but the vulnerability was exploited before all organizations could apply it [1].

The attacks have been attributed to opportunistic threat actors who target any Internet-exposed SharePoint server. The vulnerability, known as ToolShell, was discovered in May 2025 during the Pwn2Own Berlin competition. It allows attackers to remotely execute arbitrary code on vulnerable SharePoint servers. Microsoft released a patch in June, but the vulnerability was exploited before all organizations could apply it [1].

The attacks have been attributed to opportunistic threat actors who target any Internet-exposed SharePoint server. The vulnerability, known as ToolShell, was discovered in May 2025 during the Pwn2Own Berlin competition. It allows attackers to remotely execute arbitrary code on vulnerable SharePoint servers. Microsoft released a patch in June, but the vulnerability was exploited before all organizations could apply it [1].

The attacks have been attributed to opportunistic threat actors who target any Internet-exposed SharePoint server. The vulnerability, known as ToolShell, was discovered in May 2025 during the Pwn2Own Berlin competition. It allows attackers to remotely execute arbitrary code on vulnerable SharePoint servers. Microsoft released a patch in June, but the vulnerability was exploited before all organizations could apply it [1].

The attacks have been attributed to opportunistic threat actors who target any Internet-exposed SharePoint server. The vulnerability, known as ToolShell, was discovered in May 2025 during the Pwn2Own Berlin competition. It allows attackers to remotely execute arbitrary code on vulnerable SharePoint servers. Microsoft released a patch in June, but the vulnerability was exploited before all organizations could apply it [1].

The attacks have been attributed to opportunistic threat actors who target any Internet-exposed SharePoint server. The vulnerability, known as ToolShell, was discovered in May 2025 during the Pwn2Own Berlin competition. It allows attackers to remotely execute arbitrary code on vulnerable SharePoint servers. Microsoft released a patch in June, but the vulnerability was exploited before all organizations could apply it [1].

The attacks have been attributed to opportunistic threat actors who target any Internet-exposed SharePoint server. The vulnerability, known as ToolShell, was discovered in May 2025 during the Pwn2Own Berlin competition. It allows attackers to remotely execute arbitrary code on vulnerable SharePoint servers. Microsoft released a patch in June, but the vulnerability was exploited before all organizations could apply it [1].

The attacks have been attributed to opportunistic threat actors who target any Internet-exposed SharePoint server. The vulnerability, known as ToolShell, was discovered in May 2025 during the Pwn2Own Berlin competition. It allows attackers to remotely execute arbitrary code on vulnerable SharePoint servers. Microsoft released a patch in June, but the vulnerability was exploited before all organizations could apply it [1].

The attacks have been attributed to opportunistic threat actors