Microsoft links ConnectWise breach to Chinese AI-driven spy group Storm-0940
Microsoft attributes a major ConnectWise security breach to Storm-0940, a China-linked espionage group that exploited AI agents to compromise over 2,250 Microsoft 365 tenants. The attackers used the open-source ARTEX framework to automate reconnaissance and credential theft, achieving privileged access in under three hours. This incident highlights the growing threat of AI-automated supply chain attacks targeting global enterprises, governments, and financial institutions.
Key points
- Microsoft identified Storm-0940, a China-linked espionage group active since 2021, as the culprit behind the ConnectWise breach affecting 2,250 cloud tenants.
- The attackers utilized ARTEX, an open-source Go-based AI penetration-testing framework, to automate reconnaissance, vulnerability discovery, and credential attacks.
- Storm-0940 targeted diverse sectors including government agencies, defense contractors, banks, and tech firms, often gaining privileged access within three hours of initial contact.
- The breach originated from unauthorized access to ConnectWise application identities, prompting the IT management vendor to suspend its Cloud Backup, SaaS Security, and Cloud Management services.
- Microsoft notes that while Storm-0940 traditionally used password spraying, this campaign marked a shift toward AI-automated heavy lifting starting in September.
- The incident underscores the expanding attack surface of cloud environments and the efficacy of AI agents in accelerating the speed of modern cyber-espionage campaigns.
Microsoft has identified Storm-0940, a China-linked espionage group, as the primary actor behind a significant security breach involving the IT management vendor ConnectWise. The incident exposed more than 2,250 Microsoft 365 tenants to unauthorized access, impacting a wide range of organizations including government agencies, defense contractors, banks, and technology firms. Microsoft revealed that the attackers leveraged an open-source AI penetration-testing tool called ARTEX to automate the attack lifecycle, moving from initial target selection to privileged cloud access in some cases within three hours.
The breach stemmed from compromised application credentials within ConnectWise’s infrastructure. Upon discovering the unauthorized access, ConnectWise temporarily suspended its Cloud Backup, SaaS Security, and Cloud Management services to contain the damage. While the vendor initially struggled to pinpoint the source, Microsoft’s analysis traced the activity to Storm-0940, a group that has operated since at least 2021. Traditionally reliant on password spraying and exploiting internet-facing applications, this group marked a tactical shift by integrating AI agents to handle reconnaissance and credential theft more efficiently.
The use of ARTEX, a Go-based framework designed for automated vulnerability discovery and data theft, illustrates the evolving nature of cyber-espionage. By automating complex tasks, the attackers reduced the time required to compromise secure environments, posing a heightened risk to global supply chains. This development signals to enterprises that AI-driven tools are becoming standard in the arsenals of state-aligned threat actors, necessitating updated defensive strategies for cloud-based identity management.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.
