LiveUpdated
Microsoft links Storm-0940 to ConnectWise Cloud Backup supply chain attack
Microsoft says a China state-aligned actor, Storm-0940, used the ARTEX AI penetration testing framework in the ConnectWise Cloud Backup compromise. Outlets differ on how many organizations were targeted.
Written and kept up to date by the SecurityTabs AI newsroom from 4 outlets, and published automatically. Each paragraph cites its sources. CVSS, EPSS and KEV status below come directly from NVD, FIRST and CISA, not from the AI.
What happened
Microsoft disclosed on Wednesday that a China state-aligned actor it calls Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application, according to The Hacker News. The Record reports that Microsoft described the group as Chinese government-aligned and said it used automated tools in the attack on ConnectWise. [1][2]
The ARTEX tool
The Hacker News says Storm-0940 used ARTEX, a Go-based agentic AI penetration testing framework, to speed up the intrusion. The outlet reports that ARTEX was made closed-source after it was abused in attacks on South Korean financial institutions. Dark Reading says the tool automated and accelerated the attack. [1][3]
Scale and impact
Reports on scale differ. Dark Reading says the attack hit more than 2,200 tenants. SecurityWeek says the hackers targeted hundreds of organizations and gained privileged access to some environments. The Record reports Microsoft said the actor is using the same techniques to try to compromise organizations around the world. [3][4][2]
What is not yet known
The articles reviewed do not list CVE identifiers, indicators of compromise or a vendor fix for the Cloud Backup compromise. The reconciled number of affected organizations has not been published in these reports. [1][3][4]
Business Action
What this means inside your organization, and what to do about it, by company size.
Small business
No dedicated security staff; relies on providers
Mid-size company
A small IT or security team
What to know
Microsoft says the actor is using the same techniques against organizations worldwide. No mitigation or indicators were published in the reviewed articles. [2][4]
What to do
- Confirm whether ConnectWise Cloud Backup is deployed and who has administrative access to it. [1][4]
- Review privileged access the backup service holds in your environment, since attackers gained privileged access in some cases. [4]
- Monitor ConnectWise and Microsoft advisories for indicators and guidance. [2]
Large enterprise
A security operations team
What to know
Microsoft attributes the activity to a China state-aligned actor using ARTEX automation. Public indicators were not included in the reviewed coverage, and the affected-organization count is disputed between outlets. [1][3][4]
What to do
- Inventory ConnectWise Cloud Backup tenants and third-party providers that use it. [1][3]
- Hunt for unusual privileged access originating from backup or MSP integrations, and track Microsoft reporting on this actor for detections. [4][2]
- Ask ConnectWise and service providers for incident status and confirmation of whether your tenant was affected. [3]
Timeline
SecurityWeek reported the actor targeted hundreds of organizations and gained privileged access to some. [4]
Dark Reading reported the attack affected more than 2,200 tenants. [3]
Microsoft disclosed that Storm-0940 was behind the ConnectWise Cloud Backup supply chain compromise. [1][2]
· coverage
Earliest coverage cited in this report: The Hacker News. [1]
Sources
- [1]The Hacker News · Oct 22, 04:21 UTC
China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attackcontext - [2]The Record · Oct 22, 16:30 UTC
Microsoft blames ConnectWise attacks on Chinese state hacker using ARTEX AI agentscontext - [3]Dark Reading · Oct 22, 20:42 UTC
Microsoft Links Storm-0940 to ConnectWise Supply Chain Attackcontext - [4]SecurityWeek · Oct 23, 10:31 UTC
China APT Uses AI Pentest Tool Artex in ConnectWise Attackscontext