Chinese-linked hackers compromise ConnectWise, target hundreds in global attack, Microsoft says
Microsoft said Storm-0940 used an AI penetration-testing tool to hit more than 2,250 Microsoft 365 tenants and gain persistent access at many organizations.
- On Wednesday, Microsoft reported that Chinese-linked hacking group Storm-0940 compromised ConnectWise Cloud Backup using ARTEX, an AI-driven penetration testing framework, targeting hundreds of organizations globally.
- The ARTEX framework allows attackers to automate penetration testing tasks including reconnaissance and data exfiltration with minimal human interaction, capabilities Microsoft Threat Intelligence noted are accelerating attack tempos across multiple threat actors.
- Microsoft observed more than 151,000 failed logon attempts during the campaign, peaking at 2,900 failures per minute, while Storm-0940 used ARTEX to reach more than 2,250 tenants at a pace leaving defenders minimal time to respond.
- ConnectWise temporarily shut down services Saturday following the attacks and began restoring services in phases Wednesday, though the company did not respond to Microsoft's conclusions about Storm-0940's involvement.
- Igor Tsyganskiy, executive vice president at Microsoft, stated the ConnectWise attack is "one of many" AI-driven incidents, while the Chinese Embassy in Washington did not respond to requests for comment as Beijing regularly denies cyber-enabled data theft.
47 Articles
47 Articles
TechCrunch
technewstube.comChinese hackers spied on thousands of companies after breaching IT giant ConnectWise
Microsoft points the blame for ConnectWise's breach at a China-aligned hacker, which relied on AI agents to rapidly hack into thousands of its customers.
Microsoft says China-aligned hackers used AI agents in ConnectWise attack
Microsoft says a China-aligned hacking group used AI agents to breach ConnectWise’s Cloud Backup service, opening a route into customers’ Microsoft 365 accounts. Microsoft Threat Intelligence published its findings on Storm-0940 on October 21. ConnectWise disclosed the breach in a security advisory on October 16, the same day security firm Huntress published its initial account […] This story continues at The Next Web
Campaign targeted hundreds of organizations worldwide; company warns restoring services does not eliminate potential access inside customer systems
Coverage Details
Bias Distribution
- 50% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
