New estimates regarding the recently-exploited Microsoft SharePoint vulnerabilities now evaluate that as many as 400 organizations may have been targeted.

Microsoft sees ransomware, the natural next step for phishing, as a major growing threat. This is when the hacker hijacks your system, and won't let you back in unless you pay the ransom fee.

A cyber-espionage campaign centered on vulnerable versions of Microsoft's server software now involves the deployment of ransomware, Microsoft said in a late Wednesday blog post. In the post, citing "expanded analysis and threat intelligence,

Department of Homeland Security headquarters, several of its agencies and the Department of Health and Human Services have been hacked as part of a wider breach of Microsoft SharePoint.​

Two of the crews behind the zero-day attacks are government-backed: Linen Typhoon (aka Emissary Panda, APT27) and Violet Typhoon (aka Zirconium, Judgment Panda, APT31), Microsoft's threat intel team wrote in a Tuesday blog.

Microsoft (MSFT) is trying to determine if a leak from its early alert system for cybersecurity companies created a window for Chinese hackers to attack its SharePoint service, according to Bloomberg.

Microsoft said that critical vulnerabilities in SharePoint are being exploited by a potentially China-linked threat actor, Storm-2603, to deploy ransomware.