A recent cyberattack on IT services provider ConnectWise is believed to be orchestrated by a Chinese state-affiliated hacking group, known as Storm-0940. This attack has targeted hundreds of organizations globally, raising alarm within the cybersecurity community.
According to Microsoft, the hackers employed an open-source penetration testing tool called ARTEX to exploit vulnerabilities in ConnectWise’s systems. This tool is capable of automating a variety of security testing tasks, which facilitated the rapid execution of the cyber campaign.
Scope and Impact of the Attack
It appears that a China state-aligned group was responsible for the attack on ConnectWise Cloud Backup.
Manny Rivelo, CEO of ConnectWise
The attack has affected a wide range of sectors, including aerospace, defense, automotive, chemicals, energy, and financial services, among others. While many attempted breaches were thwarted, Storm-0940 managed to establish high-level access in several organizations, posing a long-term threat.
- Targeted sectors: aerospace, defense, automotive, chemicals, energy, financial services, and more.
- Attack method: utilization of AI-driven penetration testing frameworks.
ConnectWise's CEO noted that while they have worked to contain the breach, the potential for unauthorized access may still exist within individual customer systems, necessitating further investigation.
In response, a spokesperson from the Chinese Embassy has denied any involvement, stating that China opposes hacking activities and condemns any accusations made against it regarding cybersecurity issues.