ConnectWise Cloud Backup Breach Exposes Thousands of Customers
The bad week for cybersecurity just got worse for thousands more companies, which were spied on by Chinese hackers following the breach of IT management and remote access giant ConnectWise.
Stolen Credentials Enabled Access to Customer Environments
Security researchers at Microsoft say the China state-aligned hackers, tracked as Storm-0940, broke into ConnectWise's cloud backup service and stole application credentials used to establish data links between ConnectWise and its corporate customers, who rely on the cloud service to back up their company data.
By stealing the credentials, the hackers could log in to customers' Microsoft-hosted environments as if they were authorized users and access their emails and other files.
AI Agents Drove Mass Exploitation at Unprecedented Speed
According to Microsoft, the hackers used AI agents to rapidly compromise around 2,250 organizations at a rate of almost 3,000 attempted sign-ins per minute. Microsoft said this speed gives defenders "little time to detect and respond."
The speed of the mass hacks was attributed to the use of AI agents, specifically ARTEX, an open source AI framework that works with AI models to stress-test cyber defenses. The same AI software was used in a recent compromise of South Korea's financial systems, many of which had weak security and lacked multi-factor authentication.
ConnectWise Paused Cloud Backup Service Pending Investigation
ConnectWise said it has paused access to its cloud backup system and is investigating the breach. As of Thursday, the company said it was working on restoring the service.
via TechCrunch AI