Microsoft Ties China-Linked Hackers to AI-Driven ConnectWise Breach

Microsoft identified Storm-0940, a China-state-aligned hacking group, as responsible for compromising ConnectWise Cloud Backup and then attempting to access more than 2,250 Microsoft 365 tenants in a campaign aimed at hundreds of organizations worldwide.

ARTEX is an open-source penetration-testing framework with AI-model capabilities for reconnaissance, password spraying and OAuth app abuse. It authenticated with ConnectWise application credentials through apps customers had already authorized, without an interactive user sign-in.

The campaign began as early as September. The ConnectWise-related operation recorded as many as 2,900 sign-in attempts a minute. Most activity across the broader campaign failed, but some environments saw directory reconnaissance, application credential changes and efforts to alter identities, groups and privileged roles. In some cases, attackers gained privileged cloud access in less than three hours.

Privileged access does not establish that customer data was accessed or stolen, and the full customer impact has not been disclosed. ConnectWise began restoring services in phases at 3 p.m. ET (19:00 UTC) Oct. 21. Access already established inside customer tenants requires separate review.