Tech & AI
Microsoft says China-aligned hackers used AI agents in ConnectWise breach, targeting more than 2,250 cloud tenants
Microsoft tied the supply-chain attack to the group it calls Storm-0940, which in some cases gained privileged cloud access within three hours.
HedgeWeekly Tech & AI Desk ·
Microsoft said a China state-aligned hacking group it calls Storm-0940 was behind the compromise of IT software company ConnectWise. In an October 21 security blog, Microsoft said the group used ARTEX, an open-source penetration-testing tool. Penetration-testing tools are normally used to probe a company's defences. ARTEX coordinates several AI agents, built on large language models, to run attacks from reconnaissance to data theft with little human input.
After compromising a ConnectWise application that serves many customers, the attackers tried to sign in to more than 2,250 Microsoft 365 tenants, meaning separate customer cloud environments, at up to 2,900 attempts a minute. In several cases they went from first targeting a victim to privileged cloud access in under three hours. Microsoft said the group had used ARTEX against hundreds of organisations worldwide since as early as September, in sectors including financial services, government, defence and semiconductors.
ConnectWise shut down its Cloud Backup, SaaS Security and Cloud Management services after finding unauthorised access. Chief executive Manny Rivelo said the affected connections had been contained and services were being restored step by step, The Register reported. Microsoft has not said how many customers were compromised or whether data was taken. It advised customers to keep the affected ConnectWise connections disabled and to review activity back to October 1 where records allow.
Why it matters: The attack shows how AI agents can cut the time and cost of large-scale hacking, and how a single trusted software supplier can open a route into thousands of companies. Financial firms are among the targets, and many depend on outside IT providers and cloud software. Investors will watch for disclosures by affected listed companies, any tightening of rules on supplier access to cloud systems, and whether security spending rises to defend against automated attacks.