China-nexus actor linked to attack on ConnectWise Cloud Backup | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware

Security researchers have linked a China-nexus threat group to the supply-chain attack that abused ConnectWise Cloud Backup against Microsoft 365 tenants.  
The state-aligned group, tracked as Storm-0940, used an agentic AI pen-testing tool called Artex to automate attacks against hundreds of organizations across the globe, according to a report released Wednesday from Microsoft. 
“Nation-state actors are increasingly targeting the software supply chain, because one trusted connection can open the door to many organizations,” ConnectWise CEO Manny Rivelo, said in a statement confirming the Microsoft findings. “AI now lets them test those connections at what Microsoft calls ‘machine speed.’”
ConnectWise Cloud Backup is a backup and recovery service used through managed service providers to secure Microsoft 365 and Google Workspace data. The service was previously known as SkyKick. 

ConnectWise suspended access to Cloud Backup after suspicious activity was first detected on Oct. 14. The company also shut off its SaaS Security and Cloud Management services, which are normally connected to the Cloud Backup service. 
ConnectWise is now beginning to restore service in controlled phases, Rivelo said. The company, however, warned customers to keep their connections disabled until they receive direct instructions from the company.
Artex is a multiagent LLM system written in the Go programming language and includes a Next.js front end, according to Microsoft. The Chinese-developed open-source tool can work with various AI models to automate attacks.
The tool automates penetration tests that can be used for a wide variety of tasks, ranging from reconnaissance to exfiltration of data.
The AI tooling allowed hackers to authenticate to Microsoft 365 environments without the need for an interactive user sign-in process, according to Microsoft. 
After gaining unauthorized access during the ConnectWise attack, the threat group attempted to sign in to more than 2,250 Microsoft 365 tenants at a speed of 2,900 sign-in attempts per minute, according to the report. That speed is much faster than most defenders can stop. 
Between Oct. 10 and Oct. 14, the hackers conducted a password-spraying attack targeting 327 organizations across eight organizations, attempting to reach Microsoft 365 or Exchange Online environments. Microsoft telemetry flagged 151,000 failed login attempts over the period. 
Researchers at CrowdStrike have connected Artex to a wave of AI-based attacks targeting Korean banks, and researchers in Japan have connected the tool to a campaign targeting Japanese companies. 
Researchers from Huntress said the Microsoft report lines up with threat activity it observed against security customers. 

“Our working hypothesis is that these attacks were conducted by an AI agent leveraging scripted tooling, with occasional human intervention,” Jon Semon, principal security operations analyst at Huntress, told Cybersecurity Dive. “The way the activity unfolded strongly supports that assessment and is consistent with Microsoft’s description of agent-driven activity.”
Indicators of scripted user agents and a ConnectWise application that granted itself global administrator privileges inside a customer tenant matches evidence that Huntress outlined in its report, Sermon said.

——————————————————-
Click Here For The Original Source.

Related