AI Agents Behind Breach of Thousands of Organizations via ConnectWise

Microsoft researchers said that a China state-aligned hacking group breached the cloud backup service of ConnectWise, an IT management and remote access company, and stole application credentials used to establish data links between the company and its customers. Using those credentials, the attackers were able to log into their customers' Microsoft-hosted environments as if they were authorized users, gaining access to email and other files.

Microsoft explained that the group, which it identifies as "Storm-0940," used AI agents to breach approximately 2,250 organizations at a rate of nearly 3,000 login attempts per minute—a speed that gives defenders little time to detect and respond. The company attributed this pace to the open-source "ARTEX" framework, a framework that works with AI models to test security defenses, according to TechCrunch.

Microsoft noted that the same framework was used in a recent breach of financial systems in South Korea, many of which suffered from security weaknesses and a lack of multi-factor authentication. ConnectWise stated that it disabled access to its cloud backup system and is investigating the breach, adding that on October 22 it began a gradual restoration of several cloud services after shutting them down.

On the impact, Microsoft said the victims are ConnectWise customers, companies that rely on its cloud service to back up their data, and that the stolen credentials allowed the attackers to log into their Microsoft-hosted environments. The company described the incident as an espionage campaign carried out by a group linked to the Chinese state that affected thousands of companies, according to TechCrunch.

What Do These Terms Mean?

Credentials: Information such as a username and password, or an application key, used to prove the identity of a user or system and grant access.

Multi-Factor Authentication: A method of securing an account that requires more than one verification step, such as a password and a code sent to a phone, even if the password is stolen.

Cyber Supply Chain: The network of suppliers, services, and software that a company relies on; a breach in any link poses a risk to the remaining parties.