Update to my earlier ConnectWise post. Microsoft says a China-linked group it tracks as Storm-0940 used compromised ConnectWise app credentials and AI agents to go after more than 2,250 Microsoft 365 tenants.
What’s new
- They used ARTEX, an open source AI pen-testing framework written in Go, to automate everything from recon to credential attacks. Sometimes they went from target to privileged cloud access in under three hours.
- Between October 10 and 14, a password-spraying run made 151,000+ failed sign-ins against 327 accounts. None worked, so they switched to ConnectWise’s application identities.
- Those identities used permissions customers had already granted, with no user login needed, at up to 2,900 attempts a minute.
- Most attempts failed, but some organizations ended up with persistent privileged access. Microsoft hasn’t said how many.
- ConnectWise says it contained the affected connections and is slowly restoring services.
My take
If you used ConnectWise with Microsoft 365, review your app registrations, service principals and credential changes now. Cutting off the original credentials doesn’t kick out persistence.
Have a blessed day! And Happy Hacking!
