← Back to live feed1 story
Microsoft Threat Intelligence reports that Storm-0940, a China state-aligned actor, used the AI penetration testing tool ARTEX to automate attacks on Microsoft 365 tenants via a supply chain breach of ConnectWise Cloud Backup, modifying privileges and establishing persistent access across hundreds of organizations. ConnectWise responded by suspending backup and restoration services and disabling 7 app identities, though analysts warn that overprivileged OAuth applications may have exposed a wider range of downstream customers.
Sign in to suggest
Key sources
- SOURCE@msftsecintel“used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally”x.com
- SUPPORT@reuters“Chinese-linked hackers compromise ConnectWise, target hundreds in global attack, Microsoft says”x.com
- SUPPORT@bleepincomputer“Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack”x.com
- SUPPORT@specterops“A threat actor used a vendor credential to sign in as the SkyKick app and reach customer M365 tenants”x.com
- SUPPORT@cyb3rops“One compromised OAuth application with elevated permissions could give attackers access to emails, files, and directory data across hundreds of Microsoft 365 tenants”x.com
- SUPPORT@alvierid“The potential impact of the ConnectWise supply chain attack is massive”x.com
- SUPPORT@malwarejake“disabled backups in customer M365 environments”x.com
- SOURCEhuggingnewshuggingnews.com