Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants

China-aligned threat actors dubbed Storm-0940 exploited the ConnectWise application and AI-powered penetration testing tool ARTEX to infiltrate over 2,250 Microsoft 365 tenants, according to Microsoft. The sophisticated group, operating since 2021, typically relied on traditional methods like password spraying and exploiting internet-facing applications.

However, ARTEX accelerated their attacks, automating reconnaissance, vulnerability discovery, credential attacks, and data theft. Between October 10 and 14, Storm-0940 launched more than 151,000 failed sign-in attempts against 327 accounts at eight organizations, but they never achieved a successful login. Nevertheless, they shifted their focus to compromised ConnectWise application identities, using ARTEX to attempt authentication against more than 2,250 Microsoft 365 tenants, reaching up to 2,900 attempts per minute.

The attackers aimed to exploit permissions already granted to ConnectWise services, bypassing the need for interactive user logins. Once inside, the group established persistent privileged access at numerous organizations, though Microsoft has not disclosed the exact number of compromised customers or any stolen data, emphasizing that a successful login doesn't guarantee data access.

ConnectWise CEO Manny Rivelo reported that the company had isolated the affected application connections and was gradually restoring services, noting that shutting down those connections wouldn't automatically evict attackers who had already established a foothold.