Microsoft: China-linked hackers used AI agents to target over 2,250 Microsoft 365 tenants
Microsoft attributes the attack via IT provider ConnectWise to the group Storm-0940. It used the AI tool ARTEX – in some cases it took less than three hours to gain privileged access.
Graphic: TERRA WORLD NEWS (own graphic based on the sources listed)
Microsoft holds the China-state aligned group Storm-0940 responsible for the recent supply-chain attack on customers of IT provider ConnectWise. According to Microsoft's analysis, the attackers used ARTEX, an open-source penetration testing tool in which multiple AI agents based on large language models carry out attacks largely on their own, from reconnaissance to data exfiltration. Storm-0940 is said to have used the tool against hundreds of organisations since early September.
After taking over the identities of several ConnectWise cloud applications, the attackers used their existing trust to sign in to customer environments – without an interactive user sign-in. According to Microsoft, the AI-driven sign-in attempts reached more than 2,250 Microsoft 365 tenants at up to 2,900 attempts per minute, "a pace that leaves defenders with little time to detect and respond". In some cases it took less than three hours to gain privileged access to cloud infrastructure.
Most attempts failed; Microsoft did not say how many customers were actually compromised. Targeted sectors included aerospace, energy, financial services, government and semiconductors. The company said the activity did not result from a vulnerability in Microsoft products. ConnectWise had temporarily shut down its services and is restoring them in phases.