Microsoft has linked a China-aligned hacking group known as Storm-0940 to a global cyberattack campaign that used ARTEX, an AI-enabled penetration-testing framework, to target organisations through compromised ConnectWise application credentials.
The campaign reached more than 2,250 customer tenants, with multiple organisations experiencing unauthorised privileged access to cloud environments.
In some cases, attackers obtained privileged access within three hours of initial targeting, according to Microsoft’s investigation.
Microsoft assessed that Storm-0940 was responsible for the ConnectWise supply-chain compromise. The attackers exploited access associated with a multi-tenant cloud application, allowing activity to extend into customer Microsoft 365 environments where the application had already been authorised.
ConnectWise provides cloud services used by managed service providers and their customers. Its Cloud Backup product, formerly known as SkyKick, integrates with Microsoft 365 to protect customer data.
Security researchers at Huntress reported that a compromised credential belonging to the service was used to obtain Microsoft Graph access tokens across customer tenants.
This approach allowed the attackers to exploit an existing trust relationship rather than separately compromising every customer’s credentials. Depending on the permissions granted to an application, such access can expose cloud resources or enable changes to directory settings and privileges.
ARTEX accelerated the campaign by automating offensive security tasks, including reconnaissance, scanning and password attacks. Microsoft describes the framework as an open-source, multi-agent system that uses large language models to coordinate penetration-testing workflows with limited human intervention.
The framework can help agents organise discovered assets and vulnerabilities and coordinate subsequent actions. Microsoft’s findings indicate that ARTEX increased the scale and speed of the operation, while the compromised application credentials provided a route into downstream cloud environments.
Microsoft also documented a separate password-spraying campaign between October 10 and 14. Investigators recorded more than 151,000 failed logon events against 327 accounts across eight organisations, with activity peaking at approximately 2,900 failed attempts per minute.
Microsoft observed no successful authentication or subsequent Microsoft Graph activity from that particular password-spraying campaign.
The failed login activity should be distinguished from the ConnectWise application-credential abuse, which involved a different access mechanism. Microsoft reported unauthorised privileged access in multiple customer environments but did not establish that every tenant reached by the broader campaign was fully compromised.
ConnectWise began containment measures after identifying unauthorised application access. The company disabled affected application identities, suspended Cloud Backup and took its SaaS Security and Cloud Management services offline as a precaution. It reported completing an account and credential reset on October 19.
In its October 21 incident update, ConnectWise said controlled service restoration had begun and was expected to take several days. The company also warned that disabling the affected vendor-side connections could not automatically remove access that attackers might already have established within individual customer tenants.
Discover more from Aree Blog
Subscribe now to keep reading and get access to the full archive.
