China-linked hackers attacked Microsoft 365 through ConnectWise’s cloud

After gaining access to ConnectWise’s cloud service, the China-linked state-sponsored group Storm-0940 launched a large-scale supply chain attack. In other words, the hackers targeted a service’s many customers through that service. Using stolen application credentials, they attempted to access more than 2,250 Microsoft 365 environments. They used AI-powered agents to accelerate the process.

The stolen credentials belonged to cloud applications that connect ConnectWise with corporate customers. Those applications were recognized as trusted services without user involvement. This allowed the hackers to access customers’ systems. Although they were able to view emails and files, it is not known what data they took. It also remains unclear how the credentials were stolen and how many customers were affected.

The open-source ARTEX system was used to automate the attack. The system uses AI models to conduct security testing without human intervention. It scans the network, gathers information, tries numerous passwords, and abuses OAuth applications that grant access. At some targets, elevated privileges were obtained less than 3 hours after the first attempt. Such agents can operate around the clock with little human intervention.

The automated password attempts targeted 327 accounts at 8 organizations. More than 151,000 failed login attempts were recorded in total. On October 11, the attack rate reached 2,900 attempts per minute. The number of login attempts that day exceeded 111,000. Each of 48 accounts had more than 1,000 failed attempts. Security systems blocked approximately 98% of all attempts.

Credentials for 4 applications were used in the attack. They were used to log in to systems more than 200 times in less than 4 minutes. By October 16, unauthorized access to 162 environments had been confirmed. The following day, attempts to connect to approximately 1,000 Microsoft Entra environments were detected from the IP address used in the attack, and more than 300 logins were successful. In some environments, accounts, groups, application data, and highly privileged roles were modified. On October 15, one of the applications granted itself global administrator privileges and created new secrets that will expire in 2028.

Storm-0940 has been active since 2021. In this attack, the group targeted 14 sectors, including aerospace and defense, semiconductors, government agencies, and think tanks. Microsoft said the incident did not stem from a vulnerability in the company’s systems or a compromise of its products. ARTEX has previously also been linked to attacks on South Korean financial institutions. Anthropic Claude Code is believed to have been used in those attacks. The system’s creator, who uses the alias Autumn-27, announced that the project would no longer be updated and that the software’s code would be made closed-source.

As a precaution, ConnectWise suspended access to its Cloud Backup, SaaS Security, and Cloud Management services. A phased restoration of the cloud backup service known as SkyKick has begun. The process is expected to take several days. So far, there is no indication that partners’ backups were compromised. A successful login to the application does not confirm that data was read or extracted. Customers are advised to disable affected application connections and review login records from October until official recovery instructions are issued.