The Record by Recorded Future • 19h
Chinese State-Sponsored Ransomware Campaigns Exploiting N-able RMM and Microsoft SharePoint
Chinese state-sponsored threat actors are pivoting from long-term espionage to high-velocity ransomware deployment. By exploiting critical vulnerabilities in Microsoft SharePoint and weaponizing N-able Remote Monitoring and Management (RMM) tools, attackers have compressed the dwell time from weeks to hours. This strategy leverages legitimate administrative software for lateral movement and automated payload execution, targeting Managed Service Providers (MSPs) and global enterprise sectors to maximize disruptive impact and financial gain while evading traditional detection mechanisms through the use of trusted system tools.