Storm-0940 used AI agents to abuse ConnectWise’s app, Microsoft says
- Vendors
- ConnectWise, Microsoft
Microsoft assesses that Storm-0940, a group it calls China-state aligned, was behind the attack that used ConnectWise Cloud Backup’s app identity to get into customers’ Microsoft 365 tenants. It says the group used ARTEX, an open-source framework of AI agents for penetration testing, to speed up the attack. In some tenants the agents went on to change app credentials, groups and privileged roles, which Microsoft says can keep access open after the app is fixed. Microsoft published new indicators, detections and hunting queries.
Microsoft says Storm-0940 has been active since 2021 and steals data from organizations in many industries, usually getting in by password spraying or exploiting internet-facing applications. ARTEX is a multi-agent LLM system written in Go that can use any AI model and runs a penetration test from reconnaissance to exfiltration with little human input. Microsoft says the group has used it since as early as September against hundreds of organizations, sometimes reaching privileged access in under 3 hours.
Microsoft ties the ConnectWise attack to an earlier password spray. From Oct 10 to 14, it says, sprayed 327 accounts at eight organizations, with more than 151,000 failed sign-ins and none that succeeded. ConnectWise later listed the same address as an indicator. Microsoft says the agents then used the stolen app credentials from the same range to sign in to customer tenants. The apps were already trusted there, so no user had to sign in.
Microsoft says neither an affected app nor a successful sign-in shows that data was accessed or taken. It says the activity didn’t come from a compromise of, or a flaw in, Microsoft’s systems, products or services. Its hunting queries list three ConnectWise app IDs, though its guidance refers to four, and it hasn’t said how many tenants saw follow-on activity.
- Vendors
- ConnectWise, Microsoft
What to do
8 steps
Indicators
IPs copy defanged. Use Copy raw for queries.
| Type | Value | Note |
|---|---|---|
| IP address | Sign-ins and Graph activity in ConnectWise app customers’ tenants, per Microsoft | |
| IP address | Same activity, and the Oct 10–14 password spray, per Microsoft | |
| IP address | Sign-ins and Graph activity in ConnectWise app customers’ tenants, per Microsoft | |
| IP address | VPN address that reached Graph through the apps, relevant for Oct 15–16 only | |
| IP address | VPN address that reached Graph through the apps, relevant for Oct 15–16 only | |
| IP address | VPN address that reached Graph through the apps, relevant for Oct 15–16 only | |
| App ID | ConnectWise Cloud Backup app, in Microsoft’s hunting queries | |
| App ID | ConnectWise MS Teams app, in Microsoft’s hunting queries | |
| App ID | ConnectWise MS Graph app, in Microsoft’s hunting queries | |
| User agent | Seen in sign-ins and Graph activity, per Microsoft | |
| User agent | Seen in sign-ins and Graph activity, per Microsoft | |
| User agent | Seen in sign-ins and Graph activity, per Microsoft | |
| User agent | Seen in sign-ins and Graph activity, per Microsoft | |
| User agent | Seen in sign-ins and Graph activity, per Microsoft |
- IP addressSign-ins and Graph activity in ConnectWise app customers’ tenants, per Microsoft
- IP addressSame activity, and the Oct 10–14 password spray, per Microsoft
- IP addressSign-ins and Graph activity in ConnectWise app customers’ tenants, per Microsoft
- IP addressVPN address that reached Graph through the apps, relevant for Oct 15–16 only
- IP addressVPN address that reached Graph through the apps, relevant for Oct 15–16 only
- IP addressVPN address that reached Graph through the apps, relevant for Oct 15–16 only
- App IDConnectWise Cloud Backup app, in Microsoft’s hunting queries
- App IDConnectWise MS Teams app, in Microsoft’s hunting queries
- App IDConnectWise MS Graph app, in Microsoft’s hunting queries
- User agentSeen in sign-ins and Graph activity, per Microsoft
- User agentSeen in sign-ins and Graph activity, per Microsoft
- User agentSeen in sign-ins and Graph activity, per Microsoft
- User agentSeen in sign-ins and Graph activity, per Microsoft
- User agentSeen in sign-ins and Graph activity, per Microsoft
Timeline
- Oct 10–14Storm-0940 infrastructure sprays passwords at 327 accounts in eight organizations, with no successful sign-in, Microsoft says.
- Oct 15Public reports of the ConnectWise compromise cite addresses in the same range.
- Oct 16ConnectWise publishes its first advisory, and later adds an address that matches the spray’s.
- Oct 21Microsoft ties the attack to Storm-0940 and publishes indicators and hunting queries.
Sources
- Microsoft Threat IntelligencePrimary source microsoft.com