Threat actors exploit SharePoint flaws to access internal systems, steal sensitive data, and carry out surveillance, impersonation, and extortion.

In a blog post Tuesday, Microsoft said it observed hackers attempting to “gain initial access to target organizations.” According to Microsoft, those involved included hacking groups called Linen Typhoon and Violet Typhoon—which Microsoft said are linked to the Chinese government—and China-based group Storm-2603.

Microsoft said some of the hackers involved in the cyberespionage sweep aimed at the U.S. tech giant's SharePoint servers are now using ransomware, a potential escalation in the wide-ranging spy campaign.