Microsoft details how Storm-0940 used ARTEX, an open source multi-agent slopest tool, to go through ConnectWise's cloud backup and reach its customers in less than three hours.
In an analysis published on October 21, Microsoft's threat intelligence team attributes to Storm-0940, a Chinese state-aligned actor active since 2021, a supply chain attack carried out by ConnectWise Cloud Backup. This multi-tenant service had access permissions to the environments of many organizations: by compromising it, the group opened a door to their Microsoft 365 tenants, more than 2,250 in total. The targets cover hundreds of organizations in aeronautics, defense, energy, finance, semiconductors, administration or think tanks.
An automated pentest diverted
What's new is in the tooling. Since September, Storm-0940 has been using ARTEX, an open-source penetration testing framework written in Go, which orchestrates multiple LLM-based agents to chain together recognition, access, and exfiltration without human intervention. Between October 10 and 14, a password spraying campaign targeted 327 accounts across eight organizations, generating more than 151,000 failed logins, including 111,000 in a single day and peaks of 2,900 attempts per minute on October 11. With four application credentials, more than 200 sign-ins were successful in less than four minutes, and several intrusions achieved privileged access to cloud infrastructure in less than three hours.
Microsoft recommends disabling affected ConnectWise apps while waiting for restore guidelines, retaining proof of configuration, reviewing service principal connections since October 1 and Entra and Microsoft 365 audit logs, and renewing secrets and restricting third-party app permissions to what is strictly necessary.
Read the full article on the original source
Go to the source →