In a blog published on Wednesday, the American technology company attributed the attack on ConnectWise’s Cloud Backup service to Storm-0940, a group it has tracked since 2021.
“The campaign targeted organisations across sectors, including aerospace, defence, energy, financial services, government, manufacturing, semiconductors and technology,” Microsoft said.
How the attack was carried out
The group used ARTEX, an open-source penetration testing framework that uses AI models to automate security testing tasks. According to Microsoft, the tool helped accelerate scanning, reconnaissance, password-spraying attacks and the misuse of OAuth applications to access customer environments.
Microsoft said Storm-0940 attempted to sign in to more than 2,250 customer tenants at a rate of 2,900 sign-in attempts per minute.
Between October 10 and 14, the group targeted 327 accounts across eight organisations, generating more than 151,000 failed login attempts, according to Microsoft.
The company said some attacks enabled the group to gain privileged access to cloud infrastructure in less than three hours. However, most of the targeting attempts were unsuccessful.
Microsoft also clarified that the activity did not result from a compromise of, or vulnerability in, its own corporate systems, products or services. It cautioned that successful authentication did not necessarily mean customer data had been accessed or stolen.
“Although Microsoft identified Storm-0940-initiated authentication and follow-on activity in multiple customer environments, the presence of an affected application or successful threat actor authentication does not necessarily indicate that customer data was accessed or exfiltrated,” it said.
ConnectWise responds to the breach
News agency Reuters reported that ConnectWise CEO Manny Rivelo said the company’s assessment, based on Microsoft’s analysis and evidence available to ConnectWise, indicated that “a China state-aligned group was responsible for the attack on ConnectWise Cloud Backup”.
Rivelo said the company had “contained the affected application connections and are restoring services in controlled phases”.
He also cautioned that these measures did not eliminate unauthorised access that might already have been established within individual customer environments, which would require separate reviews, Reuters said in its report.
ConnectWise began restoring services in phases after temporarily shutting them down following the attack, CyberScoop reported. The company advised customers to keep connections disabled while recovery work continued.
China rejects allegations
A spokesperson for the Chinese Embassy in Washington rejected the allegations, saying China “opposes and fights hacking activities in accordance with the law,” Reuters reported. The spokesperson added that Beijing opposed “smears and attacks against China under the excuse of cybersecurity issues.”
In its blog, Microsoft said the incident demonstrated how threat actors were using AI agents to automate existing attack methods and attempt to compromise multiple organisations at greater speed. The company also said it had identified threat actors from different regions using ARTEX to expand their capabilities.
Leave a Reply