Microsoft Says China-Linked Hackers Used AI to Accelerate ConnectWise Attacks
Storm-0940 used an agentic AI penetration-testing tool to automate reconnaissance, password spraying and cloud application abuse, with some attacks reaching privileged access in under three hours.
Topics
News
- External Review Finds Flaws in OpenAI’s Agent Monitoring System
- Microsoft AI System Outperforms General Physicians in Diagnostic Tests
- How Sundar Pichai Uses AI Agents to Track Google Operations
- Tech Mahindra Partners With SpaceXSI to Scale AI-Powered Coding
- Barclays to Cut 5,000 Jobs as AI Drives Cost Savings
- CERT-In Warns of Compromised eMudhra Certificate Authority Keys
A China-linked hacking group used an artificial intelligence-powered penetration-testing framework to accelerate attacks against organizations worldwide, including a supply-chain compromise involving ConnectWise Cloud Backup, Microsoft said.
Microsoft Threat Intelligence said in an October 21 report that the group, which it tracks as Storm-0940, used the open-source ARTEX framework to automate attacks targeting hundreds of organizations across sectors including aerospace, defense, energy, finance, government, manufacturing, semiconductors and technology.
ARTEX uses AI agents to automate offensive-security tasks from reconnaissance through data exfiltration with limited human involvement. Microsoft said Storm-0940 used it for scanning, password spraying and abuse of OAuth applications linked to downstream victims.
In several cases, attackers obtained privileged access to cloud environments less than three hours after targeting began. Microsoft said the majority of attempted compromises were unsuccessful, but Storm-0940 established privileged cloud persistence at multiple organizations.
The campaign included an automated password-spraying operation between October 10 and 14 that targeted 327 accounts across eight organizations. Microsoft recorded more than 151,000 failed login attempts, peaking at about 2,900 attempts per minute. It said that phase did not result in successful authentication.
The attackers subsequently abused compromised application identities associated with ConnectWise Cloud Backup, formerly SkyKick, to attempt sign-ins across more than 2,250 Microsoft 365 tenants. Because the applications had already been granted access by customers, the activity did not require an interactive user login.
Microsoft observed follow-on activity in some environments, including reconnaissance, changes to application credentials and attempts to modify privileged roles. It cautioned that successful authentication alone does not establish that customer data was accessed or stolen.
ConnectWise said in its security advisory that it identified unauthorized access to Cloud Backup application identities and suspended affected services while resetting credentials and investigating the incident. The company said it had no evidence that stored backup archives had been compromised.
Microsoft advised organizations that use or previously used the affected ConnectWise applications to keep them disabled, preserve sign-in and audit records, and investigate unexpected credential, permission or administrator-role changes before restoring access.
