Microsoft has linked the recent compromise of ConnectWise supply chains to the Storm-0940 hacking group, which is affiliated with the Chinese state. Since September, the group has utilized the open-source ARTEX framework, a system of AI agents designed to automate cyberattacks by performing reconnaissance, vulnerability scanning, and data extraction.
The attackers compromised ConnectWise Cloud Backup to gain control over application credentials, allowing them to access Microsoft 365 client environments without interactive user logins. Once inside, AI agents facilitated reconnaissance via Microsoft Graph, credential modification, and privilege escalation attempts, including efforts to gain global administrator rights.
The scale of the automation is significant, with Microsoft reporting attempts to access over 2,250 client environments at a rate of up to 2,900 login attempts per minute. In a separate password-spraying campaign between October 10 and October 14, attackers targeted 327 accounts across eight organizations, resulting in over 151,000 failed login attempts.
Microsoft clarified that the incident did not stem from vulnerabilities in its own corporate systems or products, but rather from the exploitation of a compromised third-party application. While successful authorization does not confirm data theft, investigators observed further malicious activity, such as reconnaissance and persistence efforts, in several client environments.
