China-linked hackers used agentic AI in attack on 2,250 Microsoft 365 tenants

Summary

Microsoft Threat Intelligence attributed an attack to Storm-0940, a China-state-aligned actor that compromised a ConnectWise cloud backup application and used the open-source ARTEX agentic AI framework. The group used the stolen identities of ConnectWise cloud apps to sign in to more than 2,250 Microsoft 365 tenants at up to 2,900 attempts per minute, in some cases gaining privileged cloud access in under three hours. Microsoft said the activity did not stem from a flaw in its own products.

Topics

• AI agents

Related items

• MediumChinese hackers spied on thousands of companies after breaching IT giant ConnectWiseSame vendor · TechCrunch (Security)
• InfoBill Gates says to prepare for 20 years of ‘tumultuous’ AI disruptionSame vendor · The Verge (AI)
• MediumARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software VendorsSame vendor · Wiz Research Blog
• InfoAI firms say UK has a year to head off datacentre protests before construction is threatenedSame vendor · The Guardian Technology
• MediumChina-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain AttackSame vendor · The Hacker News