Chinese‑linked hackers breach ConnectWise customers

Microsoft identified the China‑linked threat actor Storm‑0940 as the force behind a recent supply‑chain compromise of the SaaS platform ConnectWise. The group used the open‑source AI pentesting framework ARTEX to accelerate reconnaissance, password spraying and OAuth application abuse, targeting hundreds of Microsoft 365 tenants in mid‑October. The attack began in early September, with the attackers stealing ConnectWise Cloud Backup credentials and then automating access to customers’ cloud environments.

Rapid password spraying

The attack generated an extraordinary volume of authentication attempts: 2,900 sign‑in attempts per minute, 151,000+ failed log‑ins across eight organisations, and 48 accounts that each recorded more than 1,000 failures. On October 11 alone, 111,000 failed attempts were logged. Because the pace was so high, ConnectWise had to suspend several services, including Cloud Backup, SaaS Security and Cloud Management, to contain the breach.

ARTEX, originally released on GitHub earlier this year, is an AI‑driven penetration testing platform that can run autonomous attacks from reconnaissance to data exfiltration. The framework uses any AI model to plan and execute tasks, and its developers said it was designed for learning and research. After the abuse was discovered, Chinese cybersecurity engineer Li Puhua announced that ARTEX would be closed‑source and no further updates would be provided.

Persistence and remediation

After gaining initial access, Storm‑0940 leveraged Microsoft Graph to perform directory reconnaissance and altered application credentials to establish persistence. In several environments the attackers also modified identities, groups and privileged roles, leaving a backdoor that could survive if the compromised application was later removed. Microsoft advises organisations to audit service principal sign‑ins, review Microsoft Graph activity and check for unauthorized changes to directory objects.

Storm‑0940’s use of ARTEX illustrates how AI can speed up supply‑chain attacks. The framework allows attackers to run multiple attack paths simultaneously, work continuously, and reduce the time from targeting to privileged access to fewer than three hours in some cases. Similar AI‑powered activity has been observed against South Korean financial institutions and other sectors, showing that the tool is being used by a range of threat actors.