Microsoft attributes ConnectWise intrusion to China-linked group using AI penetration testing tool ARTEX

Microsoft released a technical report attributing the ConnectWise Cloud Backup supply chain intrusion to the China state-linked group Storm-0940, stating that it used the open-source AI penetration testing framework ARTEX to reach 2,250 Microsoft 365 tenants. The report states that during the password spraying phase from October 10 to 14, more than 151,000 failed logins were launched against 327 accounts at 8 organizations, peaking at 2,900 per minute, all unsuccessful. After obtaining credentials for a ConnectWise cloud application account on October 15, the agent switched to logging in directly through the already authorized application without user interaction, and in some environments entered Microsoft Graph to conduct directory reconnaissance and modify application credentials to establish persistent backdoors; Microsoft states that such modifications may remain effective after the original application is remediated. Microsoft states that in some attacks, less than 3 hours elapsed from initial positioning to obtaining cloud privileged access.