Cybersecurity threats are popping up everywhere, with last week marking a significant incident labeled as Black October by experts. While that situation grabbed headlines, Microsoft was simultaneously monitoring another serious matter that impacted numerous businesses globally.
Right before the php2shell threat escalated online, Microsoft’s Threat Intelligence team was investigating a significant breach targeting enterprise systems. They discovered that a Chinese hacking group known as Storm-0940 had exploited an AI testing platform named ARTEX to execute automated attacks on hundreds of companies, with the goal of stealing sensitive information.
ConnectWise, an IT management software firm, has acknowledged its uncertainty about which partners may have been compromised or if any data was exfiltrated.
The situation worsened as attackers were able to access various companies’ cloud backup systems, where sensitive encrypted information was stored under privileged access. Shockingly, it only took three hours for these automated attacks to dismantle cybersecurity defenses, which is drastically quicker than the usual 5 to 10 hours that security experts generally require to breach a system.
This rapid and methodical attack underscores the significant dangers posed by AI, especially against outdated or poorly secured online infrastructures that may contain undiscovered vulnerabilities.
ConnectWise offers a wide array of services including remote monitoring and management of servers, laptops, and desktops, as well as cloud backup for crucial business data. Notable partners listed include companies like Swarovski, Bic, and Panasonic, although the total client roster exceeds 20,000 entities.
Basically, ConnectWise is deeply woven into the operational fabric of its partners, granting access to crucial devices and data that hackers would find appealing. Thus, instead of attacking individual companies, cybercriminals can simply target ConnectWise directly to access a wealth of information.
According to Microsoft, the hackers affiliated with the Chinese state executed a supply chain attack on the OAuth application that safeguards ConnectWise Cloud Backup. This service is vital as it holds client backup data. Once they infiltrated the system, the hackers attempted to alter system privileges to broaden their access. However, Microsoft has stated there’s no current evidence showing that any client data was taken, only that unauthorized access was gained.
In response, ConnectWise promptly revoked the certificates linked to Cloud Backup, effectively nullifying the attack. They also confirmed that their clients’ backup archives remain securely encrypted, implying that even if hackers did manage to transfer data, it should still be protected. So far, there’s been no evidence suggesting any archives were compromised.
However, the absence of evidence doesn’t rule out the possibility of a breach. ConnectWise has admitted that their system lacks the capability to track their clients’ saved data, leaving them uncertain about which partners were targeted or if data was actually moved. As a result, ConnectWise is urging its customers to check their own data for any signs of unauthorized access.
This incident involving ConnectWise is just a fragment of a larger unfolding crisis where AI bots are tirelessly scouring the web for unpatched vulnerabilities to exploit. The unfortunate reality is that everyone — businesses, infrastructure, and individuals alike — is at risk. That said, there are measures you can take. We’ve compiled a comprehensive list of suggestions on how to safeguard your information, accounts, and private data amidst the ongoing PHP meltdown and any potential cybersecurity threats that may arise in the future.
