Cybersecurity threats are emerging left and right, with the most prominent event happening last week in what experts call Black October. However, while that web meltdown took most of the oxygen out of the room, Microsoft was tracking another event that affected hundreds of companies around the globe.
Days before the php2shell threat hit its peak of hysteria online, Microsoft’s Threat Intelligence team was focused on a major event that directly attacked enterprise systems. It found that a Chinese hacking group called Storm-0940 weaponized an agentic AI testing platform named ARTEX to launch automated attacks on hundreds of companies worldwide, intending to steal data.
ConnectWise admits that it doesn’t know which partners were hacked or if any data was moved.
Even worse, the attack led to bad actors accessing some companies’ cloud backup systems, which contained sensitive encrypted data locked behind privileged access. It only took three hours for the automated attacks to breach cybersecurity measures — far fewer than the 5-10 hours that security experts typically need to crack a system.
The speed and efficiency of the attack further outlines how AI poses an existential risk to online infrastructure that is either outdated, unsecured with the latest software, or riddled with zero-day vulnerabilities that have yet to be discovered.
One of the groups affected by the attack was ConnectWise, an IT management software company that provides a list of services, including remote monitoring and management for company servers, laptops, and desktops; remote access features to offer help-desk support; and cloud backup and recovery for critical business data. Some of the partners on its website include Swarovski, Bic, and Panasonic, though the full client list includes more than 20,000.
In short, ConnectWise is directly integrated into the digital fabric of its partners with access to devices, data, and everything else hackers would love to take for themselves. That means that attackers who want to get to ConnectWise’s partners don’t have to go to each company and hack them individually. They can simply target ConnectWise itself to obtain a treasure trove of data.
RELATED: How to protect yourself and your data during the PHP web meltdown
According to Microsoft, the Chinese-state hackers used AI to implement a supply chain attack on the OAuth app that protects ConnectWise Cloud Backup, the service that contains client cloud backup data. Once inside, hackers reportedly tried to change the system privileges to broaden data access. However, Microsoft notes that there’s currently no proof that client data was actually accessed or taken — just that hackers broke into the system.
ConnectWise was quick to respond. The company revoked the certificates connected to Cloud Backup to cut the hackers off. This rendered their supply chain attack null and void. ConnectWise also confirmed that its clients’ cloud backup archives are still securely encrypted, so if hackers did move data out of ConnectWise’s system, it should still be safe. The company has found no evidence so far that any of the archives were taken.
That said, a lack of evidence doesn’t necessarily mean a crime didn’t occur. ConnectWise admits that its systems aren’t built to track its clients’ saved data. As a result, it doesn’t know which partners were hacked or if any data was moved. Instead, ConnectWise customers are compelled to review their own data for signs of tampering.
The ConnectWise breach is just one piece of a broader emerging situation where AI bots scour every corner of the web, looking for unknown flaws to exploit. At this point, no one is safe — businesses, infrastructure, and private citizens. Still, that doesn’t mean there’s nothing you can do. We surfed the web and compiled a robust list of ways you can protect yourself, your accounts, and your private data from the PHP meltdown and any other major cybersecurity event that could unfold over the coming months and years.
Like Blaze News? Bypass the censors, sign up for our newsletters, and get stories like this direct to your inbox. Sign up here!
Continue reading...
[H/T Blaze Media]
