The tech giants have evidence that Chinese hackers are exploiting the new bug, but warned "multiple actors" are also hacking into affected SharePoint systems.

Microsoft says the Chinese threat actors Linen Typhoon, Violet Typhoon, and Storm-2603 have been exploiting the ToolShell zero-days.

CISA has mandated immediate mitigation for federal agencies, while analysts urge enterprises to accelerate cloud migration and implement live threat detection.