Victim Profiles in Microsoft SharePoint Attacks Point to Targeted Intelligence Campaign, Researchers Say

‘The attackers knew exactly what they were looking for,’ said Lodi Hensen.

A man looks at his phone as he passes the Microsoft stand at the Mobile World Congress trade show in Barcelona, Spain, on March 3, 2025. Bruna Casas/Reuters

Eye Security, a Netherlands-based cybersecurity company that has been tracking Microsoft SharePoint attack victims, said an analysis of victims shows that nearly one-third were government-sector systems.

“From the data, it’s clear this wasn’t a random or opportunistic campaign. The attackers knew exactly what they were looking for,” Lodi Hensen, Eye Security vice president of security operations, said on July 29 in a blog post.