Microsoft says the Chinese threat actors Linen Typhoon, Violet Typhoon, and Storm-2603 have been exploiting the ToolShell zero-days.

Microsoft released an emergency security patch on Sunday to “mitigate active attacks targeting on-premises servers.”

Microsoft has responded to the recent global SharePoint vulnerability, stating that it has identified at least three breaches linked to China.

A newly discovered vulnerability in Microsoft’s SharePoint platform has spurred a mad frenzy from hackers — leading to breaches of some Microsoft clients.

Microsoft issued an emergency fix to close off a vulnerability in its SharePoint software that hackers have exploited to carry out widespread attacks on businesses and at least some federal agencies.

Microsoft said in a post on its website on Saturday that it was “aware of active attacks targeting on-premises SharePoint Server customers by exploiting vulnerabilities.” SharePoint is a Microsoft platform that allows customers to manage and share documents within their organizations.