{"id":3328,"date":"2025-05-30T14:49:35","date_gmt":"2025-05-30T13:49:35","guid":{"rendered":"https:\/\/aegislens.com\/home\/?p=3328"},"modified":"2025-05-30T14:49:35","modified_gmt":"2025-05-30T13:49:35","slug":"connectwise-reveals-potential-government-backed-cyberattack","status":"publish","type":"post","link":"https:\/\/aegislens.com\/home\/connectwise-reveals-potential-government-backed-cyberattack\/","title":{"rendered":"ConnectWise Reveals Potential Government-Backed Cyberattack"},"content":{"rendered":"

ConnectWise Discloses Suspected State-Sponsored Hack<\/h1>\n

ConnectWise, a Florida-based, software provider, has recently disclosed a suspected state-sponsored hack that impacted ScreenConnect users.<\/p>\n

Investigations are underway to confirm if an advanced persistent threat (APT) group is behind the cyber-attack, which exploited a high-severity ASP.NET vulnerability.<\/p>\n

Overview of The Attack<\/h2>\n

The attacked unfolded when threat actors exploited a path traversal vulnerability identified as CVE-2019-18935 within the Telerik UI.<\/p>\n

This high-severity ASP.NET vulnerability enables an attacker to execute arbitrary commands, leading to control over the ASP.NET application.<\/p>\n

ScreenConnect users were then targeted by the attack, causing ConnectWise to disclose the security incident publicly.<\/p>\n

The company quickly removed the software build containing the vulnerability to curb the attack.<\/p>\n

The Impact of the Attack<\/h2>\n

ScreenConnect, now renamed ConnectWise Control, is a self-hosted remote desktop software solution widely used by IT departments and tech support teams.<\/p>\n

In this incident, hackers exploited the vulnerability to potentially gain unauthorized access to sensitive corporate resources and data.<\/p>\n

If the suspicion of state-sponsored hacking is confirmed, this underscores the critical need for organizations to keep all software patched and up-to-date to protect against known vulnerabilities.<\/p>\n

The ConnectWise Response<\/h2>\n

Upon identifying the breach, ConnectWise swiftly initiated steps to mitigate the impact, starting by disabling the compromised software build.<\/p>\n

In their official communication, ConnectWise underscored its commitment to providing a safe and secure environment for users.<\/p>\n

They have also engaged a third-party forensics team to conduct a thorough investigation of the incident.<\/p>\n

In response to this incident, the company is urging its customers to review their systems, apply patches where necessary, and adopt multi-factor authentication (MFA) for enhanced account security.<\/p>\n

This breach proves once again the crucial role of timely patch updates, rigorous system checks, and advanced security measures in corporate risk management.<\/p>\n

Cybersecurity Best Practices<\/h2>\n

While updates and patches help mitigate risks, organizations cannot afford to be complacent about cybersecurity.<\/p>\n

The best defense against hacks and data breaches includes:<\/p>\n