Microsoft says the ConnectWise cyberattack Storm-0940, a China state-aligned group by its assessment, used an AI-assisted penetration-testing framework to compromise ConnectWise Cloud Backup and pursue access to customer Microsoft 365 environments. The company says the operation shows how attackers can automate the tedious parts of an intrusion, then exploit a trusted third-party application already holding permissions inside a customer tenant.
ConnectWise CEO Manny Rivelo said the company had contained the affected application connections and was restoring services in controlled phases. He warned that containment does not remove unauthorized access that may already have been established within individual customer tenants, which require separate review.
Microsoft tracks the actor as Storm-0940 and says it has operated since 2021. The attribution is Microsoft’s assessment, based in part on IP addresses publicly reported by ConnectWise that matched infrastructure in Microsoft’s own investigations. A Chinese Embassy spokesperson said China opposes hacking and also opposes accusations against China made under the pretext of cybersecurity.
How did the ConnectWise attack reach Microsoft 365 customers?
According to Microsoft, the group used ARTEX, an open-source framework that can work with different AI models to automate penetration-testing tasks. Penetration testing is ordinarily authorized security testing. ARTEX can coordinate software agents across tasks including reconnaissance and data exfiltration with limited human interaction, Microsoft said.
Microsoft said Storm-0940 used the framework to speed up scanning and password spraying, an attack that tries common passwords against many accounts. It then abused OAuth applications that already had access to downstream victims’ Microsoft 365 environments. In this case, a compromised Cloud Backup application could provide a route into connected customer tenants beyond the access for which the application was intended.
Microsoft reported that, in some environments, the activity continued beyond authentication into Microsoft Graph and directory operations. The observed actions included reconnaissance, changing application credentials to retain access, and modifying identities, groups and privileged roles. Those actions could enable persistent access, but Microsoft did not disclose how many ConnectWise customers were compromised or report a confirmed count of data-theft victims.
What Microsoft says it observed
- From September, Storm-0940 targeted hundreds of organizations in sectors including government, aerospace, defense, finance, manufacturing, energy and technology, Microsoft said.
- In a four-day password-spraying operation ending October 14, it targeted 327 Microsoft 365 and Exchange Online accounts across eight organizations and generated more than 151,000 failed logons, according to Microsoft.
- Microsoft said activity peaked at 2,900 failed sign-in attempts per minute and that ARTEX was used to reach more than 2,250 tenants.
- Most targeting did not succeed, Microsoft said, though it reported privileged cloud persistence at many organizations in a short period.
Those figures describe attempted authentication activity, not a confirmed victim total. A successful login does not by itself establish that an intruder accessed or removed data, a distinction that gets lost quickly once “AI” enters the incident report.
ConnectWise said services were being restored in phases and advised customers to keep affected connections disabled while recovery continued. The case is also a reminder that third-party application permissions deserve scrutiny: an attacker that obtains a trusted app’s credentials may not need to break into every customer environment separately.
This story draws on original reporting from The Record.
