Microsoft's SharePoint servers face escalating attacks from Chinese state hackers pivoting from espionage to ransomware via ToolShell vulnerabilities (CVE-2025-49706 and CVE-2025-49704), collaborating with groups like Storm-2603 using Warlock. Patches are available, but experts urge immediate updates, MFA, and isolation to prevent widespread breaches and hybrid threats.