Microsoft links ConnectWise breach to China-aligned hackers using AI

First reported by CRN at · Updated · 13 sources

Microsoft identified the attackers as Storm-0940 and said they used the ARTEX AI penetration-testing framework to attempt access to more than 2,250 Microsoft 365 tenants. The group used compromised ConnectWise application identities for cloud access, with activity reaching 2,900 sign-in attempts per minute, according to reports describing Microsoft's findings.

  • Some targets reached privileged access in under three hours, RuntimeWire reported, citing Microsoft.
  • ConnectWise said affected services would return in stages over several days, according to CRN.

Covered by 13 publishers within 43 hours of the first report.

Reporting13

CRN MSPs Scramble To Determine Microsoft 365 Tenant Impact In ConnectWise Cloud Backup Breach · sburke@thechannelcompany.com (Steven Burke)
CyberScoop Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group · Matt Kapko
RuntimeWire Microsoft links ARTEX attacks to more than 2,250 ConnectWise tenants · Ryan Merket
The Economic Times Chinese-linked hackers compromise ConnectWise, target hundreds in global attack, Microsoft says
The Hacker News China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack · info@thehackernews.com (The Hacker News)
Cyber Security News China-Linked Hackers Use ARTEX AI to Target 2,250 Microsoft 365 Tenants After ConnectWise Breach · Tushar Subhra Dutta
The Next Web Microsoft says China-aligned hackers used AI agents in ConnectWise attack · Ana-Maria Stanciuc
The Record Microsoft blames ConnectWise attacks on Chinese state hacker using ARTEX AI agents
TechCrunch Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise · Zack Whittaker
Dark Reading Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack · Jai Vijayan
Security Affairs Microsoft Links ConnectWise Breach to China-Linked Group Using AI Pentesting Tool ARTEX · Pierluigi Paganini
Tom's Hardware China-aligned hackers deploy AI agents in massive ConnectWise supply chain attack · Shane Downing
SecurityWeek China APT Uses AI Pentest Tool Artex in ConnectWise Attacks · Ionut Arghire

Related

Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites
CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers
Attacker used ARTEX AI to breach South Korean financial firms
Hackers hide behind Microsoft's own websites to get past email filters and launch phishing campaigns

Topics MicrosoftData breaches