微软称中国关联黑客借 ConnectWise 漏洞窥探数千家企业
Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise
微软安全研究人员称，与中国政府关联的黑客攻破 ConnectWise 的云备份服务，窃取用于建立数据链路的应用程序凭据，从而能以授权用户身份登录客户的 Microsoft 托管环境，访问邮件和其他文件。黑客使用 AI 智能体以每分钟近 3000 次登录尝试的速度入侵约 2250 家机构，微软称这一速度让防御方几乎没有时间检测和响应。所用 AI 框架为开源的压力测试框架 ARTEX，该框架此前也被用于韩国金融系统遭入侵事件。ConnectWise 表示已暂停云备份系统访问并展开调查，截至周四正在恢复服务。
推荐理由
精选AI 评分 78
微软披露的攻击细节显示，AI 智能体把撞库速度推到每分钟近 3000 次登录尝试，为防御方留下的响应窗口被大幅压缩。
主题
正文
The bad week for cybersecurity just got worse for thousands more companies, who were spied on by Chinese hackers following the breach of IT management and remote access giant ConnectWise.
Security researchers at Microsoft say the China state-aligned hackers broke into ConnectWise’s cloud backup service and stole application credentials that are used to establish data links between ConnectWise and its corporate customers, who rely on the cloud service to backup their company’s data.
By stealing the credentials, the hackers could log in to the customer’s Microsoft-hosted environment as if they were an authorized user and access their emails and other files.
According to Microsoft, the hackers used AI agents to rapidly hack into around 2,250 organizations at a rate of almost 3,000 attempted sign-ins per minute. Microsoft said this speed gives defenders “little time to detect and respond.”
The speed of the mass-hacks were attributed to the use of AI agents, specifically ARTEX, an open-source AI framework that works with AI models to stress-test cyber defenses. The same AI software was used in a recent compromise of South Korea’s financial systems, many of which had weak security and lacked multi-factor authentication.
ConnectWise said it’s paused access to its cloud backup system and is investigating the breach. As of Thursday, the company said it was working on restoring the service.