Multiple hacking groups—including state actors from China—have targeted a vulnerability in older, on-premises versions of the file-sharing tool after a flawed attempt to patch it.

Microsoft said some of the hackers involved in the cyberespionage sweep aimed at the U.S. tech giant's SharePoint servers are now using ransomware, a potential escalation in the wide-ranging spy campaign.