The ConnectWise cyberattack exposed application credentials used by its Cloud Backup service, potentially giving China-aligned hackers a route into customers’ Microsoft 365 environments. Microsoft says the group used AI-assisted attacks to attempt access to more than 2,250 organizations.
In an Oct. 21 security report, Microsoft attributed the activity to Storm-0940. The stolen credentials allowed attackers to impersonate trusted cloud applications and potentially access customer emails and files.
ConnectWise Cyberattack Accelerated by AI Tools
The hackers used ARTEX, an open-source AI penetration-testing framework, to automate attacks at approximately 2,900 sign-in attempts per minute. Microsoft observed unauthorized activity in multiple customer environments, including attempts to modify application permissions.
However, Microsoft cautioned that attempted access does not necessarily mean customer information was stolen. The total number of organizations experiencing successful intrusions remains unclear.
ConnectWise confirmed the credential compromise and temporarily suspended Cloud Backup, SaaS Security and Cloud Management. Its security advisory says it is restoring services in stages. The company has found no evidence that existing encrypted backup archives were compromised.
Customers should review Microsoft 365 authentication records and unexpected permission changes. ConnectWise recommends keeping affected connections disabled until it provides instructions for restoring access.
ARTEX also appeared in attacks targeting South Korean financial institutions, according to CrowdStrike researchers. South Korean reporting indicated that seven financial firms experienced information leaks affecting more than 67,000 people.
Investigators have not established a connection between those incidents and the ConnectWise breach. The company continues investigating the attack while restoring its cloud services.
