China-linked hackers target 2,250 Microsoft 365 tenants after ConnectWise breach
Key Takeaways China-linked threat actors, identified as Storm-0940, utilized an AI-powered penetration testing framework named ARTEX. The campaign targeted over 2,250 Microsoft 365 tenants following...
Key Takeaways
- China-linked threat actors, identified as Storm-0940, utilized an AI-powered penetration testing framework named ARTEX.
- The campaign targeted over 2,250 Microsoft 365 tenants following a breach of ConnectWise Cloud Backup.
- Attackers leveraged stolen application credentials and pre-approved permissions, circumventing the need for user passwords.
- The attack involved rapid sign-in attempts, with Microsoft observing 2,900 attempts per minute, making detection and blocking challenging.
- Defenders should disable affected ConnectWise connections, preserve forensic evidence, and conduct thorough investigations into application credentials and permissions.
A state-aligned hacking group believed to be operating from China has deployed an AI-driven penetration testing framework, ARTEX, to launch attacks against more than 2,250 Microsoft 365 tenants. This sophisticated campaign emerged in the aftermath of a security incident involving ConnectWise Cloud Backup.
Table Of Content
Microsoft, which has designated the threat actor as Storm-0940, reported an alarming rate of 2,900 sign-in attempts per minute. This rapid tempo significantly compressed the window for security teams to investigate and neutralize the intrusions, as detailed in an internal report. Rather than attempting to crack user passwords, the attackers exploited application credentials and permissions that customers had already authorized, gaining access without requiring direct user interaction.
Previous reports concerning the compromised ConnectWise backup credentials indicated successful unauthorized access across 173 tenants. It is crucial to distinguish this figure from Microsoft’s broader count of targeted tenants; not all attempted sign-ins were successful, and successful authentication does not automatically imply data exfiltration.
Researchers from Zscaler and Microsoft teams separately documented the misuse of ARTEX in reports published on October 21. It is important to note that ARTEX is a legitimate security testing framework, not a novel malware. While Microsoft attributed the ConnectWise attack specifically to Storm-0940, Zscaler’s investigation focused on a broader workflow employed by a Chinese-speaking operator, without definitively linking both sets of activities to the same specific actor.
China-Linked Hackers Use ARTEX AI
Microsoft’s technical investigation report details Storm-0940’s use of ARTEX for various malicious activities, including scanning, password spraying, and abusing OAuth applications. Between October 10 and 14, the group’s infrastructure launched attacks against 327 accounts spanning eight different organizations, resulting in over 151,000 failed login attempts. During this period of password spraying, Microsoft did not observe any successful authentications.
The threat group, known for using stolen accounts for network infiltration, adopted a new tactic in the ConnectWise incident: exploiting stolen application credentials. This allowed the attackers to authenticate as trusted applications, leveraging permissions already established within customer tenants, thereby bypassing the need for interactive user sign-ins.
After seizing control of multiple ConnectWise application identities, the attackers utilized Microsoft Graph to survey target environments and modify application credentials. This activity included manipulating identities, groups, and privileged roles. Such modifications could enable persistent access through other applications, even if the initial compromised ConnectWise connection was severed. Microsoft noted that several ARTEX-powered attacks achieved privileged cloud access in under three hours.
Zscaler’s investigation revealed how an operator integrated ARTEX with various AI workspaces, including Claude Code, Codex, and others. The framework was designed to break down overarching objectives into smaller tasks, execute security tools, and systematically record its findings. Custom additions to the ARTEX toolkit included nmap, sqlmap, nuclei, and Android analysis tools, expanding its reconnaissance and exploitation capabilities across web applications, networks, and mobile platforms.
These recent findings build upon earlier reports of ARTEX involvement in financial breaches in South Korea. Zscaler’s analysis indicates a wider targeting scope, encompassing numerous countries and sectors. Saved prompts within the ARTEX environment requested sensitive data such as personal records, phone numbers, payment credentials, and transaction information. Inquiries about selling stolen data suggested financial motivations, though no actual sale was confirmed.
The operational methodology also involved shared notes and synchronization scripts, allowing different AI sessions to continue unfinished work. Prompts assigned initial research to DeepSeek and review responsibilities to GLM, while other sessions operated with Grok configurations. Zscaler cautioned that the configured model names do not definitively reveal the underlying AI models used to fulfill requests. Furthermore, the operator instructed agents to treat targets as authorized and reduced approval requirements, streamlining the attack process.
What You Should Do
- Disable ConnectWise Connections: Keep all affected ConnectWise connections disabled until official restoration guidance is issued.
- Preserve Evidence: Before deleting any applications, ensure all relevant forensic evidence is preserved.
- Review Service Principal Sign-ins: Scrutinize all service principal sign-ins for suspicious activity.
- Examine Application Credential Additions: Check for any unauthorized additions of application credentials.
- Audit Consent Grants and Role Changes: Review consent grants and any changes to roles for anomalies.
- Investigate Authorized Integrations: Extend investigations to previously authorized integrations, as removing the original connection might not eliminate attacker-added credentials elsewhere.
- Monitor Microsoft Graph Activity: Look for unusual activity within Microsoft Graph, including mailbox access, file downloads, forwarding rules, and unexpected ownership changes.
Indicators of compromise (IoCs)
| Source | Type | Indicator | Reported context |
|---|---|---|---|
| Microsoft | IP | 144.172.64[.]128, 144.172.64[.]99, 144.172.64[.]60 |
Sign-ins and Graph activity |
| Microsoft | VPN IP | 187.15.88[.]186, 187.15.90[.]217, 187.15.89[.]186 |
Time-limited Graph investigation |
| Microsoft | User agent | Python-urllib/3.12, python-requests/2.31.0, python-requests/2.34.2, curl/7.88.1, azure-toolkit/1.0 |
Observed application activity |
| Microsoft | Application ID | 506e08f9-6e9a-4da4-942b-a099a03644ae |
ConnectWise Cloud Backup |
| Microsoft | Application ID | 24205314-2b89-4e07-a2a4-579e898a5640 |
ConnectWise MS Teams |
| Microsoft | Application ID | 0de14c77-b9b0-4137-9360-348
|
No Comment! Be the first one.