Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group - CyberScoop
Microsoft has attributed a recent supply-chain attack targeting ConnectWise customers to a China-state aligned threat actor known as Storm-0940.
Microsoft researchers identified Storm-0940 as the actor behind the breach of ConnectWise’s Cloud Backup service. The group initiated a widespread password-spraying campaign immediately before the compromise, targeting 327 Microsoft 365 and Exchange Online accounts across eight organizations. During a four-day stretch ending Oct. 14, the threat actor made more than 151,000 failed logon attempts, peaking at 2,900 failures per minute.
The next day, Storm-0940 used the same malicious infrastructure to target ConnectWise customers directly. The group leveraged the agentic AI penetration testing framework ARTEX to accelerate scanning and conduct automated attacks. Microsoft said the threat actor used ARTEX to reach more than 2,250 tenants at a rate of 2,900 sign-in attempts per minute.
Microsoft researchers observed that the AI agents progressed beyond authentication to Microsoft Graph and directory operations. The group conducted reconnaissance, modified application credentials to establish persistence, and altered identities, groups, and privileged roles. Microsoft identified multiple customer environments with evidence of follow-on activity, highlighting how a compromised third-party application with high privileges can provide access beyond its intended purpose.
In some of these environments, the AI agents (on behalf of the threat actor) progressed beyond authentication to Microsoft Graph and directory operations, including reconnaissance, application credential modifications to establish persistence, and changes involving identities, groups, and privileged roles.
The open-source framework works with any AI model to automate offensive security workflows, including data exfiltration. Microsoft Threat Intelligence noted that multiple threat actors from various regions are using ARTEX to strengthen their capabilities and speed up the tempo of attacks. The company did not disclose how many customers were compromised, noting that successful authentication does not necessarily indicate data theft.
ConnectWise temporarily shut down services on Saturday in response to the attacks and began restoring them in phases on Wednesday. The company advised customers to keep connections disabled and expects the recovery process to take several days. Microsoft’s Igor Tsyganskiy described the ConnectWise incident as part of a broader wave of AI-driven cyberattacks that began in early October.
Related
