ConnectWise LLC

The arrests were part of Operation Serengeti 3.

Microsoft says that a Chinese state-aligned group is responsible for the ConnectWise cloud backup hack last week.

The hack was part of a larger AI automated hacking spree that hit hundreds of targets around the globe.

Microsoft tracks the group as Storm 0940.

This was a live automated campaign.

They turned a ConnectWise supply chain breach into a major incident.

This machine speed attack hit more than 2,250 Microsoft 365 tenants.

Let's break down exactly how this happened mechanically.

The hackers initially stole ConnectWise cloud backup application credentials.

They used that trusted access against various downstream corporate customers.

But instead of humans manually typing commands, they automated the whole thing.

By the time an IT admin gets an alert, the AI has already taken the data.

Los atacantes usaron Artex, un framework de inteligencia artificial de código abierto que ejecuta una prueba de penetración completa de forma autónoma, desde el reconocimiento hasta el robo de datos, y obtuvieron acceso privilegiado en cientos de objetivos en menos de tres horas.

El punto de entrada fue la cadena de suministro del respaldo en la nube de ConnectWise.

Jmm.

Y en los mercados, las acciones de inteligencia artificial registraron una fuerte caída el jueves, arrastrando a los índices bursátiles de todo el mundo.

And we're talking major, right? API call, API connections, pulling data from other vendors.

I mean, just amazing stuff that we've been asking companies like Kaseya or ConnectWise to do.

And 10 years later, there's no movement.

These guys are doing it in one day.

And by the way, Microsoft is finger pointing.

They're saying that China State Aligned Hacking Group used AptX AI agents to exploit ConnectWise supply chain breaches, attempting to access more than 2,250 Microsoft 365 accounts.

It's been ongoing all week.

They're blaming China.

But it's not, when I think of cloud, I think of cloud native.

Like we were on ConnectWise.

My ConnectWise server is still in my office.

We were on it 15 years.

I have all my ticket data.

Managed service providers are also in the firing line.

Microsoft recently attributed a supply chain attack on ConnectWise Cloud Backup to the threat actor known as Storm0940, who used the RTX malware.

The cascading impact here is what makes supply chain attacks so dangerous.

When a service provider is compromised, every downstream customer is potentially at risk.