Microsoft said some of the hackers involved in the cyberespionage sweep aimed at the U.S. tech giant's SharePoint servers are now using ransomware, a potential escalation in the wide-ranging spy campaign.

A critical vulnerability in on-premise SharePoint servers allowed state-backed hackers to breach governments and institutions worldwide. Experts are questioning why more hasn't been done or said.

Multiple hacking groups—including state actors from China—have targeted a vulnerability in older, on-premises versions of the file-sharing tool after a flawed attempt to patch it.