A Chinese nation-state group used the open-source AI penetration-testing framework ARTEX to abuse compromised ConnectWise Cloud Backup applications and target Microsoft 365 tenants.
Microsoft on Wednesday disclosed the campaign, which it attributed to a Chinese nation-state group it tracks as Storm-0940. The hacking group, which has been active since 2021, has historically gained initial access through password spraying and exploitation of internet-facing applications.
In its latest campaign, which began as early as September, the hacking group used ARTEX to automate attacks against hundreds of organizations globally across a broad range of industries.
“While the majority of the targeting wasn’t successful, Storm-0940 achieved privileged cloud persistence at many organizations in a brief time,” Microsoft said.
After gaining control of identities for multiple ConnectWise cloud applications, the attackers used ARTEX to attempt to sign in to more than 2,250 tenants at a rate of 2,900 sign-in attempts per minute.
Separately, between Oct. 10 and 14, Storm-0940 ran an automated password-spray campaign against 327 accounts across eight organizations to gain access to Microsoft 365 and Exchange Online. Microsoft telemetry captured more than 151,000 failed logon events, with activity peaking on Oct. 11 at 2,900 failures per minute and more than 111,000 failures in a single day. Microsoft said that campaign did not result in any successful sign-ins.
Because the hackers used stolen credentials linked to applications that had already been granted access to the Microsoft environment, they could operate without requiring an interactive user sign-in. The attackers then used Microsoft Graph, the company’s REST API endpoint for accessing data, intelligence, and services across Microsoft 365 services.
They carried out reconnaissance and made application credential and identity changes to establish persistence across downstream Microsoft 365 tenants.
“The activity conducted by the threat actor through the usage of ARTEX framework did not result from a compromise of or a vulnerability in Microsoft corporate systems, products, or services,” Microsoft added.
On Oct. 17, ConnectWise disabled seven affected application identities and revoked the certificates used for affected application connections. Two days later, the company completed a full reset of all accounts and credentials in the affected Cloud Backup environment.
“We continue advancing remediation and security validation as we prepare for phased service restoration,” ConnectWise said.
Although ConnectWise has taken remedial steps, Microsoft noted that attackers could still use other identities and credentials as potential backdoors.
The company further recommended examining service principal sign-ins alongside Microsoft Graph activity, directory changes, and resource access to spot suspicious activity tied to authorized administrative accounts. However, it added that “the presence of an affected application or successful threat actor authentication does not necessarily indicate that customer data was accessed or exfiltrated.”
