Microsoft links ConnectWise breach to Storm-0940 using AI tool ARTEX
Original title: Microsoft Links ConnectWise Breach to China-Linked Group Using AI Pentesting Tool ARTEX
Stolen application credentials were used against 2,250 Microsoft 365 tenants, with privileged access in under three hours in some cases.
Microsoft named China state-aligned Storm-0940 as responsible for the ConnectWise Cloud Backup supply-chain compromise and said the group used the AI penetration-testing framework ARTEX. After a failed password-spraying wave from October 10 to 14, the group used stolen ConnectWise cloud application credentials from October 15 to sign into customer Microsoft 365 tenants without interactive user logins. In some environments the agents ran Microsoft Graph reconnaissance, changed application credentials for persistence, and tried to alter identities, groups, and privileged roles.
Unconfirmed: Microsoft assesses Storm-0940 was responsible; that attribution is the company’s assessment.
- Password spraying from 144.172.64.99 produced more than 151,000 failed logins against 327 accounts at eight organizations.
- Activity peaked at 2,900 failed attempts per minute on October 11; none of those attempts succeeded.
- With valid credentials, agents made 2,900 sign-in attempts per minute across 2,250 tenants.
- Microsoft says added service-principal credentials can survive revocation of the original ConnectWise connection.
- Zscaler and Recorded Future also saw a Chinese-speaking group use ARTEX against South Korean financial institutions.
Impact: Privileged access to customer Microsoft 365 and cloud infrastructure.
| Product | Affected |
|---|---|
| ConnectWise Cloud Backup | — |
- 1.Review service principal credential additions since at least October 1.
- 2.Treat revoked ConnectWise connections as insufficient if attackers added their own application credentials.
- ATT&CK
- T1110.003 Password SprayingT1078 Valid AccountsT1098 Account ManipulationT1199 Trusted Relationship
- Vendors
- MicrosoftConnectWise
- Threat actors
- Storm-0940
- Malware
- ARTEX
- Organizations
- ZscalerRecorded Future
- Countries
- ChinaSouth Korea
From the original article
3 min read at securityaffairs.com
China-linked Storm-0940 used AI tool ARTEX to target 2,250 Microsoft 365 tenants, exploiting stolen ConnectWise credentials at machine speed. Microsoft published a detailed technical report naming Storm-0940, a China state-aligned group, as the actor behind the ConnectWise Cloud Backup supply chain compromise. The group used ARTEX, an open-source AI-driven penetration testing framework, to run attacks […]
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.