Microsoft links Chinese state group to ConnectWise supply chain attack via AI pentesting tool
Microsoft said a China-aligned nation-state group known as Storm-0940 used ARTEX, an open-source penetration-testing tool that coordinates multiple AI agents to run an entire attack on its own, from reconnaissance to data exfiltration, to breach ConnectWise, an IT management software provider, and through it hundreds of other organizations worldwide since September. After gaining access to ConnectWise's multi-tenant application, the group used ARTEX to accelerate scanning, password spraying, and abuse of OAuth applications, reaching privileged access at some organizations in under three hours from initial targeting, with sign-in attempts against more than 2,250 customer tenants at up to 2,900 attempts per minute. Targets spanned aerospace, defense, energy, financial services, semiconductor manufacturing and think tanks, and ARTEX had already been linked, without official confirmation at the time, to earlier bank breaches in South Korea. For a business that depends on an IT management software vendor or any application with broad access to customer systems, the case shows how quickly an AI tool can turn one compromised application into a channel for hundreds of simultaneous attacks.
Sources
This summary was written automatically with AI from the public sources listed above and checked by an independent AI reviewer before publication. For full details, read the original source.