Microsoft has scaled back access for some Chinese companies to its cybersecurity early warning system, following suspicions that sensitive information from the program may have been misused during a hacking campaign targeting its widely used SharePoint servers.
The move comes after a wave of cyberattacks last month, which Microsoft and other experts partly blamed on Beijing. Although China has denied involvement, the timing of the attacks raised concerns that details shared through Microsoft’s Active Protections Program (MAPP) — designed to give security vendors early insight into vulnerabilities — may have leaked.
It was previously reported that Microsoft had alerted MAPP participants to SharePoint vulnerabilities on June 24, July 3 and July 7. Exploitation attempts were first detected on July 7, leading cybersecurity experts to suspect a rogue participant shared or misused the information.
In a statement, Microsoft said it would no longer provide several Chinese firms with “proof of concept code,” a tool that simulates malware and is meant to help defenders patch systems quickly but can also be repurposed by hackers.
Microsoft added: “We are aware that the information we provide could be exploited, which is why we take steps – both known and confidential – to prevent misuse. We continuously review participants and suspend or remove them if we find they violated their contract with us which includes a prohibition on participating in offensive attacks.”