Expired50% confidenceEventExact time
The attackers first breached the systems of IT management software vendor ConnectWise, then used ConnectWise as a springboard to launch intrusions against its thousands of downstream customers.
1
Sources
50%
Confidence
Short-term (~14 days)
Relevance
10/22/2026
First Seen
This claim has expired. It is kept for the record and no longer describes the current state.
Valid until: 11/5/2026(expired)
Sources
Related Entities
Related Claims
UnverifiedConnectWise suffered a multi-tenant supply chain attack: attackers used stolen vendor credentials to log into Microsoft 365 tenants as a trusted application.68% similarUnverifiedIn a supply chain penetration attack, the attacker first compromises a third-party service provider with weaker security protection, then uses its legitimate access permissions to enter the general contractor's network.67% similarUnverifiedMicrosoft points to a China-aligned hacking group as the mastermind behind the ConnectWise data breach.64% similarUnverifiedA reverse shell has the victim machine actively initiate an outbound connection to the attacker's server, exploiting the asymmetry of firewalls being relatively permissive toward outbound connections to bypass inbound filtering.64% similarUnverified攻击者可以通过供应商的管理后台、不安全的API接口或弱口令获得访问权限，批量控制门店的制冷设备，形成'单点突破、多点瘫痪'的攻击模式。62% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1086375API
curl https://kongchang.com/api/v1/knowledge/claims/1086375MCP
get_claim(id=1086375)