Microsoft Ties China-Linked Hackers to AI-Driven ConnectWise Breach

Microsoft identified Storm-0940, a China-state-aligned hacking group, as responsible for compromising ConnectWise Cloud Backup and then attempting to access more than 2,250 Microsoft 365 tenants in a campaign aimed at hundreds of organizations worldwide. ARTEX is an open-source penetration-testing framework with AI-model capabilities for reconnaissance, password spraying and OAuth app abuse. It authenticated with ConnectWise application credentials through apps customers had already authorized, without an interactive user sign-in. The campaign began as early as September. The ConnectWise-related operation recorded as many as 2,900 sign-in attempts a minute.

Source: TokenPost