Microsoft said on Wednesday that a Chinese government-aligned group used AI tools in the recent ConnectWise attack, The Record reported. Microsoft calls the group Storm-0940. It used ARTEX, an open-source tool that lets AI agents run break-in steps with little human help. ConnectWise shut down several services over the weekend after warnings about an attack on its Cloud Backup service. The Record reported that attackers used stolen Cloud Backup credentials.
Microsoft said the group has targeted government, defense, finance, energy and other sectors since September. Most targeting failed, but in multiple cases the group reached privileged access in under three hours. It signed in to Microsoft 365 through apps that customers had already granted access. The Record's account does not say how the credentials were stolen or how many customers were hit. ARTEX's developer said on October 8 that the tool will get no more updates and will turn closed source.
Microsoft counted 2,900 sign-in attempts a minute. It said slow spraying across many accounts was mixed with heavy attempts on chosen ones: 48 accounts had over 1,000 failures, and lockouts made up nearly 98% of activity. A vendor app with standing access to Microsoft 365 is a way in if its credentials leak. Which vendor apps hold that access, who can revoke it, and are sign-in rates watched?