Microsoft announced in a blog post on Wednesday that certain hackers linked to a cyberespionage operation targeting its SharePoint servers have begun deploying ransomware.

This shift suggests the spying campaign may be escalating into more destructive forms of cyberattack.