Microsoft ties ConnectWise backup abuse to Storm-0940 and ARTEX
Original title: Microsoft blames ConnectWise attacks on Chinese state hacker using ARTEX AI agents
Sign-in attempts hit 2,900 a minute, with more than 111,000 failures on October 11 alone.
Microsoft says the China-aligned group it tracks as Storm-0940 used the open-source ARTEX penetration-testing framework in a supply-chain attack on ConnectWise Cloud Backup and in attempts against other organizations. Stolen backup credentials were used to authenticate to Microsoft 365 environments where the app already had access. Since September the group has targeted government, aerospace, defense, finance, manufacturing, technology and energy organizations, often moving from targeting to privileged access in under three hours, Microsoft said. ConnectWise shut down affected services over the weekend. Developer Li Puhua said on October 8 that ARTEX would go closed source after misuse, and China’s Foreign Ministry denied knowledge of the incidents.
Unconfirmed: China’s Foreign Ministry denied knowledge, and the ARTEX developer denies responsibility for misuse.
- Microsoft says Storm-0940 has been active since 2021 and typically steals data.
- More than 111,000 failed log-on attempts occurred on October 11.
- Forty-eight accounts had more than 1,000 failures, and lockouts were nearly 98% of activity.
- Zscaler said ARTEX-backed attacks reached dozens of industries beyond South Korea, including Japan.
- ARTEX was released on GitHub earlier this year by an account known as Autumn-27.
Impact: Privileged cloud access and data collection via stolen backup credentials
| Product | Affected |
|---|---|
| ConnectWise Cloud Backup | — |
- 1.Treat ConnectWise Cloud Backup application credentials used with Microsoft 365 as compromised.
- Vendors
- ConnectWise
- Threat actors
- Storm-0940
- Malware
- ARTEX
- Victims
- ConnectWise
- Countries
- ChinaSouth KoreaJapan
From the original article
3 min read at therecord.mediaA Chinese government-aligned hacking group used automated tools to carry out the recent supply chain attack on IT management software company ConnectWise and is using the same techniques to try to compromise organizations around the globe, Microsoft said.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.