Ethical Hacking News
Microsoft has revealed that a recent security incident involving the IT management vendor ConnectWise has exposed over 2,250 Microsoft 365 cloud tenants to Chinese spies. The breach was carried out by a group of hackers tracked as Storm-0940, who used an open-source AI penetration-testing tool called ARTEX to automate their attacks. To understand the implications of this breach, read the full article to learn more about the threat of AI-powered attacks and how organizations can protect themselves.
Over 2,250 Microsoft 365 cloud tenants were exposed to Chinese spies due to a security breach by a group of hackers known as Storm-0940.The breach used an open-source AI penetration-testing tool called ARTEX to automate attacks, targeting organizations worldwide.Storm-0940 made over 151,000 failed sign-in attempts against 327 accounts at eight organizations, with some gaining privileged access in under three hours.The attackers used compromised application credentials to exploit permissions customers had already granted to ConnectWise services.The breach highlights the growing threat of AI-powered attacks and the importance of monitoring and securing cloud environments.The incident emphasizes the need for organizations to enhance their security posture, including implementing robust monitoring and incident response mechanisms.
Microsoft has revealed that a recent security incident involving the IT management vendor ConnectWise has exposed over 2,250 Microsoft 365 cloud tenants to Chinese spies. The breach was carried out by a group of hackers tracked as Storm-0940, who used an open-source AI penetration-testing tool called ARTEX to automate their attacks.
According to Microsoft, Storm-0940 used ARTEX to target organizations worldwide, including government agencies, defense contractors, banks, manufacturers, and tech firms. The group began using ARTEX as early as September to target these organizations, and by October 10-14, they made over 151,000 failed sign-in attempts against 327 accounts at eight organizations.
While most attempts failed, the hackers still managed to establish persistent privileged access at numerous organizations. Microsoft observed AI-accelerated activity through Microsoft Graph, including reconnaissance, application credential changes, and attempts to modify privileges. This allowed the attackers to potentially stick around even after the original credentials were revoked.
The attack on ConnectWise was carried out using compromised application credentials, which allowed the hackers to exploit permissions customers had already granted to ConnectWise services, without needing an interactive user login. In some cases, the hackers gained privileged access in under three hours, making it a sophisticated and fast-paced attack.
Microsoft has identified Storm-0940 as a China-linked espionage crew that has been operating since at least 2021. The group has traditionally relied on the usual tricks, including password spraying and exploiting internet-facing applications, but this time they used AI to do some of the heavy lifting.
The use of ARTEX, an open-source penetration-testing framework written in Go, allowed the hackers to automate everything from reconnaissance and vulnerability discovery to credential attacks and data theft. ARTEX is freely available for penetration testing, and Microsoft has spotted attackers from several geographic regions using the framework.
ConnectWise CEO Manny Rivelo said the company had contained the affected application connections and was gradually restoring services, although shutting down those connections wouldn't necessarily boot out attackers who had already established a foothold in customer environments.
This breach highlights the growing threat of AI-powered attacks, which can automate the process of exploiting vulnerabilities and gaining privileged access to systems. Microsoft's response to the breach underscores the importance of monitoring and securing cloud environments, as well as being aware of the potential risks associated with using AI-powered tools.
The incident also raises concerns about the use of open-source tools and the potential risks associated with relying on AI-powered penetration testing frameworks. While ARTEX is freely available, its use by malicious actors highlights the need for greater vigilance and security measures to protect against such attacks.
In light of this incident, it is essential for organizations to take steps to enhance their security posture, including implementing robust monitoring and incident response mechanisms, keeping software up-to-date, and being cautious when using open-source tools.
The breach also underscores the importance of collaboration between security vendors, researchers, and organizations to share intelligence and best practices for mitigating such threats.
In conclusion, the recent breach of ConnectWise by Storm-0940 highlights the growing threat of AI-powered attacks, which can automate the process of exploiting vulnerabilities and gaining privileged access to systems. As AI-powered tools become more prevalent, it is essential for organizations to take proactive measures to enhance their security posture and protect against such threats.
Related Information:
https://www.ethicalhackingnews.com/articles/Microsoft-ConnectWise-Breach-Exposes-2250-Cloud-Tenants-to-Chinese-Spies-via-AI-Powered-Attack-ehn.shtml
https://www.theregister.com/security/2026/10/22/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants/5304687
Published: Thu Oct 22 08:56:34 2026 by llama3.2 3B Q4_K_M
