Chinese hackers target hundreds of organizations in AI-powered ConnectWise breach

Microsoft says a group of hackers with ties to China deployed an AI-powered penetration testing tool to breach ConnectWise as part of a global operation targeting hundreds of organizations. ConnectWise’s own CEO, Manny Rivelo, also released a statement saying that all signs point to China-backed hackers for the attack on their Cloud Backup system.

After initially detecting the attack, ConnectWise immediately suspended access to its Cloud Backup, SaaS Security, and Cloud Management services. Rivelo has since confirmed that the threat is contained and is now bringing services back online using a phased, highly managed approach.

He, however, warned that while these steps secure ConnectWise, they do not clear the backdoors in already-compromised individual customer networks, meaning there must be separate security checks.

Microsoft identified the culprit, which they believe is responsible for the attack

Microsoft believes the culprit is Storm-0940, a cyberespionage group active since 2021 that aggressively targets critical sectors, including defense, aerospace, government, energy, and semiconductors, as well as various corporate and non-profit organizations.

According to the firm’s researchers, the hacker group attempted to access multiple accounts through a widespread password-spraying campaign before infiltrating ConnectWise’s Cloud Backup service.

Researchers found that Storm-0940 launched a four-day blitz leading up to October 14, zeroing in on 327 Microsoft 365 and Exchange Online accounts across eight companies. In that period, the threat actor reportedly unleashed a massive brute-force wave, logging 151,000+ failed sign-in attempts, peaking at 2,900 per minute.

The very next day, Storm-0940 pivoted to ConnectWise, utilizing agentic AI tools and the same network infrastructure to breach the Microsoft 365 systems of several ConnectWise Cloud Backup users. 

According to Microsoft, Storm-0940 executed the entire operation using ARTEX, an open-source penetration testing framework. It contended that the ARTEX framework enables operators to plug in any AI model to automate security testing and can be configured to autonomously handle tasks such as network reconnaissance and data exfiltration.

At the moment, Microsoft Threat Intelligence believes more hackers around the world are flocking to ARTEX to supercharge their operations.

Microsoft says Storm-0940 may have left backdoors that they can access

Sources claim that most of the group’s attacks failed, but Microsoft has warned that Storm-0940 still managed to quickly lock down high-level access at multiple companies that can withstand standard security cleanup efforts.

Microsoft researchers found that in some affected systems, the hacker group’s AI agents went beyond just logging in; they actively manipulated Microsoft Graph to scout the directory, tamper with application credentials to lock in access, and alter identities and high-level roles.

They also noted that several customer environments showed clear signs of follow-on activity, illustrating how a compromised third-party app with deep permissions can be exploited to reach areas it was never meant to access. 

Earlier in the investigation, according to Huntress, the perpetrators gained access to the tenant accounts of Microsoft 365 by taking advantage of a single credential that was stolen through ConnectWise Cloud Backup. At this stage, the security firm confirmed that hackers had successfully compromised 162 customer tenants.

In his explanation of how the security firm went about investigating the breach, Jon Semon, principal security operations analyst at Huntress, said, “A Huntress partner tipped us off to suspicious activity in the ConnectWise application. We began investigating, and it became a rapid response effort across many Huntress teams.”

Apart from this, Todyl, a security platform used by managed service providers, reported that the attack also targeted its systems. According to the company, the threat actor was able to log into the Microsoft 365 tenant using valid credentials.

While this may seem like an isolated incident, it certainly isn’t. Igor Tsyganskiy, executive vice president at Microsoft, asserted that aside from this recent incident, there have been many more AI-driven cyberattacks. “We just went public with details of one of many, “he noted.

Organizations that use ConnectWise Cloud Backup should investigate their Microsoft 365 environments for suspicious sign-ins, unauthorized application permissions, and unexpected changes to administrator accounts.

Security teams should also review active sessions, rotate potentially exposed credentials, revoke suspicious tokens, and remove unauthorized access privileges.

Since restoring the affected service does not automatically eliminate persistence mechanisms within customer networks, organizations may need to conduct independent investigations to determine whether attackers retained access after ConnectWise contained the initial breach.