Chinese State-Linked Hackers Breach ConnectWise Cloud Service, Compromising Data of Over 2,250 Organizations

Chinese State-Backed Hackers Breach ConnectWise Cloud Backup Platform

According to НВ — Техно: On October 23, it was revealed that Chinese hackers with government ties launched a major cyberattack on the cloud backup service ConnectWise. This breach exposed account credentials and led to attacks on approximately 2,250 organizations, with the perpetrators leveraging artificial intelligence to orchestrate their intrusion. Cybersecurity experts at Microsoft disclosed the incident, highlighting its severity for global information security.

ConnectWise, a platform designed to back up corporate data, was exploited to gain unauthorized access to customer environments hosted on Microsoft infrastructure. Using the stolen credentials, attackers infiltrated clients' email accounts and accessed sensitive files. The hacking group employed ARTEX, an open-source AI framework, to automate their attack processes. According to Microsoft, ARTEX-enabled models attempted up to 3,000 login attempts per minute, demonstrating a highly automated and persistent assault.

System Vulnerabilities and ConnectWise's Response

This same software was previously involved in cyberattacks targeting South Korea's financial systems, many of which lacked robust security measures such as multi-factor authentication, making them susceptible to breaches. In reaction to the attack, ConnectWise suspended access to its cloud backup services and initiated a thorough investigation. As of October 22, efforts were underway to restore full functionality of the platform.

This incident underscores the escalating cyber threats posed not only by nation-state actors but also by the integration of advanced technologies like AI in cyberattacks. It serves as a critical reminder for organizations worldwide to implement strong security protocols, including multi-factor authentication, to guard against similar breaches. The findings from this investigation are expected to influence future cybersecurity policies and set new standards for backup service providers.

The recent breach of ConnectWise is a stark reminder of the growing sophistication of cyber threats, particularly those leveraging advanced technologies. In a related incident, AI-driven hackers targeted over 1,200 websites across multiple countries, showcasing the alarming trend of automated cyberattacks. To understand the broader implications of these developments and how organizations can better protect themselves, read more about this extensive hacking campaign that affected numerous sites worldwide.