Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants
AI agents did the dirty work, with hackers gaining privileged access in some environments in under three hours
Chinese-aligned cyber attackers, identified as Storm-0940, exploited compromised ConnectWise application credentials to infiltrate over 2,250 Microsoft 365 tenants, according to Microsoft. The attackers utilized an open-source AI penetration-testing tool called ARTEX, which automated various stages of the attack, from reconnaissance to credential attacks and data theft.
The group, operating since at least 2021, typically employs traditional methods such as password spraying and exploiting internet-facing applications. However, this time, they leveraged AI to expedite the process, achieving privileged cloud access in under three hours for some cases. Microsoft reported 151,000 failed sign-in attempts over four days at eight organizations, with no successful logins.
Nonetheless, the attackers used compromised ConnectWise application identities to exploit permissions granted to ConnectWise services, establishing persistent privileged access in multiple organizations. The extent of customer compromise and any potential data theft remains undisclosed by Microsoft. ConnectWise CEO Manny Rivelo confirmed that the company had contained the affected application connections and was restoring services, but warned that shutting down those connections wouldn't necessarily expel attackers who had already infiltrated customer environments.
Written by urgent.news from The Register Science's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
