China group hits cloud software

Microsoft has attributed a widespread supply chain attack to Storm-0940, a threat actor aligned with the Chinese state. The breach impacted more than 2,250 Microsoft 365 tenants by compromising ConnectWise, a provider of cloud-based business software. Microsoft stated the attackers relied on ARTEX, an open-source framework that employs AI agents to automate penetration testing.

The group obtained unauthorized access to a multi-tenant ConnectWise application. They used stolen credentials to authenticate as the applications themselves, bypassing the need for interactive user sign-ins. Some intrusions achieved privileged access within three hours of the initial targeting. Microsoft noted that the activity did not originate from a vulnerability in its own systems, products, or services.

Microsoft described ARTEX as a system of large language model-driven agents that conduct autonomous tests. The tool accelerated scanning, reconnaissance, and password spraying. These agents can operate continuously with minimal human oversight. The campaign targeted 14 industries, including aerospace, defense, semiconductors, and government think tanks.

A parallel password-spraying effort targeted 327 accounts across eight organizations. This activity produced over 151,000 failed logons. On October 11, the peak rate reached 2,900 attempts per minute. Almost 98% of these attempts were locked out. No successful logins were recorded during this specific phase of the attack.

The identity takeover of ConnectWise cloud apps proved more effective. Using four application credentials, the AI agents recorded more than 200 sign-ins from the same IP range in under four minutes. The attackers moved through tenants in sorted order, seconds apart. This pattern suggested a script working from a target list.

Security firm Huntress confirmed unauthorized sign-ins at 162 tenants by October 16. By October 17, the firm counted nearly 1,000 Entra tenants with sign-in activity from the attacking IP. More than 300 of these sign-ins were successful. Huntress observed one tenant on October 15 where an app added itself to the Global Administrator role. The attackers also planted new secrets set to expire in 2028.

ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management as a precaution. The company has begun a phased restoration expected to take several days. It reported no indicators that partner backup data was compromised. Microsoft advised customers to keep affected app connections disabled until formal restoration instructions are issued.