Microsoft links ConnectWise compromise to AI automated attacks

Microsoft says in a security blog post that China aligned threat actor Storm-0940 used the ARTEX agent framework to automate attacks against hundreds of organizations. The company attributes the recently disclosed ConnectWise supply chain compromise to the group.

Storm-0940 used ARTEX for scanning, reconnaissance, password spraying and OAuth application abuse. During the ConnectWise incident, the group reached more than 2,250 customer tenants and made up to 2,900 sign in attempts per minute. In several attacks, it gained privileged cloud access less than three hours after selecting a target.

Microsoft describes ARTEX as an open-source penetration testing framework that can use any AI model to automate offensive security workflows. Microsoft observed subsequent activity through Microsoft Graph, including reconnaissance, application credential changes and attempts to modify privileges.

Microsoft advises affected organizations to keep ConnectWise application connections disabled until restoration instructions are available. Customers should preserve evidence, review service principal sign ins and audit records, and investigate unexpected credential or privilege changes. Successful authentication does not necessarily mean attackers accessed or extracted customer data.