Microsoft Ties ConnectWise Hack to China-Aligned Group

The attackers who hijacked ConnectWise’s Microsoft 365 backup application this month were not working by hand, Microsoft says. In research published on Wednesday evening, it named a China-state aligned group it tracks as Storm-0940 as the culprit, and said the group used an open-source AI agent framework called ARTEX to reach thousands of customer tenants at machine speed.

TSN tracks attacks like this on its ransomware and cyber attacks hub.

“Microsoft assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multi-tenant application,” the company’s threat intelligence team wrote. That is Microsoft’s own assessment; it is not an attribution by any government. Microsoft describes Storm-0940 as “a China-state aligned actor (with no known industry aliases) that has been active since 2021”, which targets organisations in many industries for data theft.

In brief

Microsoft says China-state aligned Storm-0940 was behind the ConnectWise Cloud Backup compromise, and used the ARTEX AI framework to reach more than 2,250 tenants at 2,900 sign-in attempts a minute.
Microsoft says some ARTEX-driven attacks went from first targeting to privileged cloud access in under three hours, and that changed app credentials can survive as backdoors after cleanup.
It is not a Microsoft vulnerability, and Microsoft says a successful sign-in does not necessarily mean data was taken. How many tenants lost data is unknown.

ARTEX turned a familiar playbook into a fast one

TSN reported last week that an attacker had used a credential belonging to ConnectWise Cloud Backup, formerly SkyKick, to sign in to customers’ Microsoft 365 tenants, forcing ConnectWise to shut off the service’s application access. Microsoft says ConnectWise publicly reported the unauthorised access on 16 October. After that, according to Microsoft, Storm-0940 “used ARTEX to reach more than 2,250 tenants at 2,900 sign-in attempts per minute”.

Abusing OAuth applications is nothing new for this group, Microsoft says. It has previously added credentials to existing apps and used them to pull email and other data through Microsoft Graph. What changed was speed. Since as early as September, Microsoft says, Storm-0940 has used ARTEX to automate attacks on hundreds of organisations worldwide, in sectors from aerospace and defence to government, legal, semiconductors and think tanks. In several cases the group gained privileged access to an organisation’s cloud infrastructure, “including multiple instances where the time from initial targeting to privileged access was less than 3 hours”.

Microsoft describes ARTEX as an open-source penetration testing framework, written in Go, that can use any AI model and runs a test “from reconnaissance through data exfiltration with little needed human interaction”. TSN reported earlier this month that CrowdStrike linked the same tool to attacks on South Korean banks. Microsoft says it has seen threat actors in multiple regions using it, but does not tie Storm-0940 to the Korean attacks.

A password spray left the trail

Microsoft’s account ties the ConnectWise intrusion to an earlier password spray. Between 10 and 14 October, an address at 144.172.64[.]99 ran an automated password-spray campaign against 327 accounts at eight organisations, generating more than 151,000 failed logons and peaking at 2,900 failures a minute on 11 October. That spray failed: Microsoft says “no successful authentication, token issuance, Graph call, or directory change was observed”. But an advisory ConnectWise posted on 16 October listed an IP address “matching exactly” the same one.

With control of several ConnectWise application identities, the AI agents then signed in to customer environments using the trust those apps already had, Microsoft says. In some tenants they went further, carrying out reconnaissance through Microsoft Graph, modifying application credentials and changing identities, groups and privileged roles. One detection Microsoft describes involves a ConnectWise management application that “directly granted itself the Global Administrator role”.

Cleanup may not close the door

Microsoft stresses two limits. The activity “did not result from a compromise of or a vulnerability in Microsoft corporate systems, products, or services”. And “the presence of an affected application or successful threat actor authentication does not necessarily indicate that customer data was accessed or exfiltrated.” It gives no count of tenants where data was taken, and says the majority of the wider ARTEX targeting was not successful.

The bigger risk, in Microsoft’s telling, is what was left behind. Credential changes made by the agents “can remain active as a backdoor”, it says, even after the original compromised application has been dealt with. It advises customers to keep the affected ConnectWise app connections disabled until ConnectWise gives formal restoration instructions, to preserve evidence before removing any enterprise applications, and to search by application ID rather than display name. Review should start from at least 15 October, Microsoft says, and where logs allow, go back to 1 October.