Microsoft ConnectWise hack: China-linked Storm-0940 hit 2,250 tenants with AI agents
Microsoft put a name on the ConnectWise hack Wednesday, and it’s a grim milestone for defenders. The company said Storm-0940, a China state-aligned hacking crew, was behind the recent supply-chain compromise of the ConnectWise Cloud Backup application — and ran its follow-on attacks through ARTEX, an agentic AI penetration-testing framework that did the break-in work at machine speed. The numbers are the story. Since September, Storm-0940 targeted hundreds of organizations worldwide, with attack attempts touching more than 2,250 Microsoft tenants at peaks of 2,900 sign-in attempts per minute. In several cases, the time from first targeting to privileged access on a victim’s cloud infrastructure was under three hours. Nobody had to type a password. ...