Microsoft blamed two Chinese nation-state actors for exploiting recently discovered security flaws in SharePoint to infiltrate vulnerable organizations, like schools, state governments, and the U.S. government’s top nuclear security agency.

Microsoft is investigating whether a leak from its early alert system for cybersecurity companies allowed Chinese hackers to exploit flaws in its SharePoint service before they were patched, according to Bloomberg News.

The hackers behind the initial wave of attacks exploiting a zero-day in Microsoft SharePoint servers have so far primarily targeted government organizations, according to researchers and news reports.

Active SharePoint exploits since July 7 target governments and tech firms globally, risking key theft and persistent access.

More information has emerged on the ToolShell SharePoint zero-day attacks, including impact, victims, and threat actors.

Providing additional updates on the breach, Microsoft said in a blog post on Tuesday that two Chinese nation-state operators, Linen Typhoon and Violet Typhoon, exploited vulnerabilities in the internet-facing SharePoint servers.

Microsoft (MSFT) is trying to determine if a leak from its early alert system for cybersecurity companies created a window for Chinese hackers to attack its SharePoint service, according to Bloomberg.