Key points
- Microsoft attributes the ConnectWise supply chain attack to the Chinese state-aligned group Storm-0940.
- The group utilized the ARTEX AI penetration testing framework to automate breach activities.
- Attackers achieved privileged access in some cases within three hours of initial targeting.
Microsoft identified the Chinese government-aligned hacking group Storm-0940 as the actor behind the recent supply chain compromise of IT management software vendor ConnectWise. According to Microsoft, the group is employing the same automated techniques to target hundreds of additional organizations worldwide. The threat actor has been active since 2021, typically focusing on data theft by targeting internet-facing applications and leveraging compromised accounts to expand their access within victim networks.
By the numbers
- Three hours: The maximum time Microsoft says it took Storm-0940 to gain privileged access in multiple instances.
- 2021: The year Microsoft states Storm-0940 began its operational activity.
- September: The month Microsoft notes the group began breaching diverse industries including finance and defense.
What to figures mean
The speed of these breaches highlights the operational impact of the ARTEX framework. Microsoft explains that ARTEX allows users to deploy any AI model to automate offensive security actions, coordinating agents that can run autonomous penetration tests from reconnaissance through data exfiltration with minimal human interaction. This automation has accelerated the group’s ability to breach targets, allowing them to acquire credentials and expand privileges rapidly. While Microsoft notes that the majority of targeting attempts were unsuccessful, the group achieved privileged cloud persistence at many organizations in a brief timeframe.
What to watch
The scope of ARTEX usage appears to be expanding beyond the ConnectWise incident. Researchers at Zscaler reported on Wednesday that attacks backed by this framework targeted dozens of industries across multiple countries, extending far beyond previous reports. Earlier this year, the tool was implicated in attacks against financial institutions in South Korea and Japan. The framework was released on GitHub as an open-source tool by an account known as "Autumn-27." On October 8, the developer, identified as Chinese cybersecurity engineer Li Puhua, released a statement on GitHub acknowledging that the tool had been abused by malicious actors.
Infection and persistence in general
Security teams analyzing AI-assisted campaigns should focus on detecting rapid privilege escalation and unusual automation patterns. These threats often arrive through compromised credentials or exposed internet-facing services. Analysts typically examine logs for sudden spikes in administrative activity or access from new geographic locations. Persistence mechanisms may involve legitimate cloud management tools or service accounts.
Teams usually check for anomalous data transfers and verify that identity providers enforce strict conditional access policies. Monitoring for automated reconnaissance behavior is critical, as AI agents can operate faster than human defenders, requiring continuous visibility into user and entity behavior to identify deviations from normal baselines.
What to do and how to stay safe: Microsoft
- Monitor cloud infrastructure logs for rapid privilege escalation or unusual administrative actions occurring within short timeframes.
- Review internet-facing applications for unauthorized access attempts and ensure strong authentication methods are enforced.
- Audit service accounts and credentials for signs of compromise, particularly those used for IT management or remote access.
- Watch for automated reconnaissance patterns that may indicate the use of AI-driven penetration testing tools.
Step-by-step guide: Account Takeover Risks and Low-Cost Defenses for Small Teams
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who is responsible for the ConnectWise breach according to Microsoft?
Microsoft attributes the breach to Storm-0940, a Chinese government-aligned hacking group.
What tool did the attackers use to automate their intrusion?
The group used ARTEX, an AI penetration testing framework released as open-source software.
How quickly did the attackers gain access in some cases?
Microsoft stated that in multiple instances, it took less than three hours to gain privileged access.
