Microsoft warned that Chinese-linked attackers were using AI agents to automate intrusions and were involved in a supply-chain attack through ConnectWise's cloud backup service. The attackers may have targeted hundreds of organizations worldwide.
Microsoft said that the attack group Storm-0940, reportedly linked to the Chinese state, was using AI agents to automate penetration testing and targeting numerous organizations worldwide. Storm-0940 is said to use a penetration-testing framework called ARTEX, which can automatically carry out activities ranging from reconnaissance to data exfiltration. It was also noted that ARTEX can switch between multiple display languages.
Regarding the supply-chain attack related to ConnectWise's cloud backup service, the analysis attributed it to Storm-0940 and described a technique that used permissions previously granted in customers' Microsoft 365 environments to impersonate legitimate applications. The attackers reportedly attempted approximately 2,900 sign-ins per minute against the tenants of more than 2,250 organizations and carried out unauthorized activities including gathering information, adding new credentials and granting administrator privileges.