From Startup Fortune · · 1m 20s
China-linked hackers breach ConnectWise with AI agent
China-linked hackers used AI to breach ConnectWise, targeting 2,250 MSPs in hours.
In brief
China-linked hackers used AI to breach ConnectWise, targeting 2,250 MSPs in hours. China-linked hackers exploited a stolen ConnectWise credential to breach 2,250 Microsoft 365 tenants via AI agent Storm-0940. Originally reported by Startup Fortune.
China-linked hackers breach ConnectWise
China-linked hackers used an AI agent to breach ConnectWise Cloud Backup service targeting 2,250 companies.
“A stolen credential inside one IT vendor's backup app let a Chinese state-aligned hacking group try to break into more than 2,250 companies in a matter of hours”
Microsoft ties Storm-0940 to breach
Microsoft said on October 21 it tied nation-state group Storm-0940 to a breach of ConnectWise's Cloud Backup service.
“Microsoft said on October 21 that it has tied a nation-state group it calls Storm-0940 to a breach of ConnectWise's Cloud Backup service”
Stolen credential used for login
Attackers stole ConnectWise's own credential to authenticate to customer Microsoft 365 tenants without password or multi-factor prompt.
“The attackers stole the app's own credential, the one ConnectWise uses to authenticate to customer Microsoft 365 tenants on its own behalf, and used it to log in as the app itself. No password. No multi-factor prompt. Just a trusted identity that nobody thought to watch.”
Huntress and Microsoft numbers
Huntress found 162 unauthorized sign-ins by October 16; Microsoft reported 2,250 attempted sign-ins at 2,900 per minute.
“Huntress, the security firm that first caught the activity, confirmed unauthorized sign-ins at 162 tenants by October 16. Microsoft's own numbers, published five days later, are far larger: Storm-0940 attempted sign-ins against more than 2,250 Microsoft 365 tenants, at a rate of roughly 2,900 attempts per minute.”
Cloud Backup disabled
ConnectWise disabled Cloud Backup and six other application identities on October 17, revoking compromised certificates.
“ConnectWise disabled Cloud Backup along with six other application identities, including parts of its Cloud Management and SaaS Security lines, on October 17, and revoked the certificates behind the compromised credential.”
AI agent used for breach
Storm-0940 ran intrusion through ARTEX, an open-source AI framework, to handle reconnaissance and credential attacks.
“Microsoft describes Storm-0940 as a China state-aligned group that has been active since 2021, focused on data theft, with no widely known public alias. That puts this breach in the same shape as SolarWinds and the Kaseya ransomware incident before it: compromise one vendor that sits inside thousands of downstream networks, and the blast radius multiplies instantly.”
MSPs affected by breach
Vulnerable MSPs include Deere, SharkNinja, Cummins, and entities tied to national security and trade.
“Vehicles include Deere, SharkNinja and Cummins, hit across four countries in a campaign that began September 25.”
MSPs should check logs
MSPs should check sign-in logs from October 15 through 17 to determine if breach succeeded.
“If your company or your portfolio companies use a ConnectWise-managed MSP, the first question isn't whether you were targeted. At this scale, assume you were in the attempt pool and find out whether the attempt succeeded. Ask the MSP directly whether Cloud Backup, Cloud Management or SaaS Security were running on your tenant, and ask for the sign-in logs from October 15 through 17, the window Microsoft and Huntress have pinned the activity to.”
The short version
China-linked hackers exploited a stolen ConnectWise credential to breach 2,250 Microsoft 365 tenants via AI agent Storm-0940.
