Top Highlights
- Storm-0940 used agentic AI tool ARTEX to automate reconnaissance, password spraying, and OAuth abuse in a supply-chain attack.
- Compromised ConnectWise Cloud Backup credentials targeted 2,250+ Microsoft 365 tenants, with up to 2,900 sign-in attempts per minute.
- Some organizations faced privileged cloud access in under three hours; most targeting attempts failed, but attackers established persistence in multiple environments.
- ConnectWise services were taken offline. Customers should keep affected connections disabled, investigate Microsoft 365 activity, preserve evidence, and verify backups before reconnecting.
Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack
AI Tool Helped Scale Attempts
Microsoft says China-linked threat actor Storm-0940 used an artificial intelligence tool to speed up a supply chain attack involving ConnectWise Cloud Backup. The tool, ARTEX, automated steps such as scanning, password attempts and misuse of app access.
Attackers tried to reach more than 2,250 Microsoft 365 customer environments through compromised application credentials. They made as many as 2,900 sign-in attempts a minute. Most attempts failed, Microsoft said. However, in several cases, attackers gained high-level cloud access within three hours of targeting an organization.
ConnectWise disclosed unauthorized access to application identities tied to Cloud Backup on Oct. 16. The company has not said how attackers first gained control of those identities. Because service providers need customer access to manage backups, a breach in one service can put many organizations at risk.
Services Remain Disrupted as Customers Investigate
ConnectWise suspended Cloud Backup, SaaS Security and Cloud Management while it investigates and restores services. The company says existing backup archives remain encrypted and isolated, with no indication that attackers compromised them. It has urged customers to keep affected connections offline for now.
Microsoft advises customers to review linked Microsoft 365 environments and preserve sign-in and audit records. Organizations should also check for new app credentials, privilege changes and unusual access. Before reconnecting, they need to confirm that attackers cannot use changed credentials to return.
The incident highlights a practical challenge: organizations may lose access to a tool they rely on to recover data. They should know which apps connect to their systems, who checks backup coverage during an outage and how to restore service safely. AI can make useful security tools faster and more widely available, but this case shows how attackers can also use automation to compress the time defenders have to respond. For businesses and the people who depend on their digital services, tested recovery plans matter as much as backups themselves.
Expand Your Tech Knowledge
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Stay inspired by the vast knowledge available on Wikipedia.
CyberRisk-V1
