Manny Rivelo, the chief executive of ConnectWise, said the company had restricted connections from the affected application and was restoring services in controlled phases after an attack on ConnectWise Cloud Backup. Rivelo said Microsoft’s analysis and the evidence available to ConnectWise indicated that a China state-aligned group was responsible.
Microsoft said on 21 October that the group, which it tracks as Storm-0940, compromised ConnectWise using ARTEX, an AI-driven penetration-testing tool. ConnectWise is a managed service provider that handles IT operations for small and medium-sized enterprises.
The attackers used ConnectWise’s trusted application identity to get around authentication without an interactive login, opening access across customer environments. That route mattered because ConnectWise sits within the IT operations of its customers.
Storm-0940 had begun using ARTEX as early as September in a campaign against hundreds of organisations worldwide, Microsoft said. ARTEX is a Chinese-developed, open-source framework built to identify system weaknesses; it can use any AI model to automate penetration-testing work, including autonomous reconnaissance and data exfiltration.
From 10 to 14 October, the group tried password-spraying attacks against 327 accounts at eight organisations. Those attempts produced more than 151,000 failed login attempts and no successful authentication.
Most of the attacks did not succeed. Yet Storm-0940 gained privileged cloud persistence at many organisations in a short period, and in some cases obtained privileged access within three hours of first targeting an organisation.
The campaign reached hundreds of organisations in aerospace, defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductors, software, technology, think tanks and non-profit organisations.
The access obtained by the group can remain in place after cleanup attempts. Rivelo said ConnectWise’s measures would not remove unauthorised access that might already have been established in individual customer tenants, which require separate review.
ConnectWise said on 16 October that it was investigating unauthorised access attempts involving its Cloud Backup environment. Recorded Future and CrowdStrike attributed the incident to Chinese-speaking threat actors using ARTEX alongside multiple AI models.
ARTEX has also been used in attacks linked to a personal-data breach affecting South Korean financial institutions. More than 100,000 records have been confirmed leaked from at least 16 financial firms since earlier that month.
The Chinese embassy in Washington did not immediately respond to a request for comment. Beijing regularly denies conducting or condoning cyber-enabled data theft.
Comments (0)