FBI: nation-state hackers breached the networks of two US municipalities last year, targeting a Microsoft SharePoint vulnerability that was patched in February
Catalin Cimpanu / ZDNet : Tweets: @gossithedog , @bad_packets , @protaapp , and @dangoodin001 Tweets: Kevin Beaumont / @gossithedog : This SharePoint vulnerability CVE-2019-0604 from a year ago is being used to breach further US organisations. I am aware of more orgs who haven't yet disclosed not in this article but some are a Big Deal. Patch rates are still TERRIBLE. https://www.zdnet.com/... @bad_packets : “Throughout 2019, this particular SharePoint vulnerability was one of the most exploited security flaws, by both financially-motivated cybercriminals, but also nation-state-sponsored cyber-espionage groups.” https://www.zdnet.com/... @protaapp : “An unpatched SharePoint server was utilized to gain access to a US municipality's network, steal the Active Directory (AD) database, compromise administrative credentials, and drop webshells for remote/backdoor access to the compromised servers” https://www.zdnet.com/... Dan Goodin / @dangoodin001 : Nation-state hackers breached the networks of two US municipalities last year, the FBI said in a security alert sent to private industry partners. Both hacks exploited already fixed SharePoint flaws https://www.zdnet.com/... by @campuscodi
Context & Ripple Effects
The FBI's alert closes a loop that opened nearly a year earlier: CVE-2019-0604 was patched by Microsoft in February 2019, yet nation-state actors still used it to breach two US municipalities, and researcher Kevin Beaumont says more breached organizations remain undisclosed because patch rates are, in his words, terrible. The same flaw served both financially motivated criminals and state-sponsored teams throughout 2019.
This is not an isolated episode. CISA later tied China's Ministry of State Security to exploitation of F5, Citrix, Pulse Secure, and Exchange bugs across US government networks in a sweeping advisory, and in July 2025 the pattern recurred at scale when Chinese-linked actors hit thousands of on-prem SharePoint servers via a fresh zero-day Microsoft rushed to patch.
First-order effects
- The two breached municipalities must now assume adversary persistence inside their networks, since the intrusions exploited a flaw fixed months before the FBI warning went out.
- Private-sector partners receiving the FBI alert face immediate pressure to audit whether their own SharePoint deployments ever received the February 2019 patch.
Second-order effects
- Beaumont's note that additional large, undisclosed victims exist means more organizations are likely to disclose or be exposed by researchers, extending the blast radius beyond the two named cities.
- Every subsequent SharePoint vulnerability now lands on a user base with demonstrated slow patching — as the 2025 zero-day wave showed, where breaches climbed from roughly 60 to ~400 organizations within a day per Eye Security's count.
Third-order effects
- If the pattern holds, US local government becomes a standing soft target for nation-state exploitation of known-but-unpatched enterprise software, pushing federal agencies like CISA to keep issuing advisories naming specific state-linked groups.
- Repeated state-sponsored abuse of Microsoft's on-prem server products strengthens the case for shifting municipal IT toward vendor-managed cloud delivery, where emergency patches deploy without local action.
The trend: Nation-state actors are systematically harvesting value from long-patched enterprise software vulnerabilities, and each FBI or CISA disclosure reveals how far behind defenders' patching really is.