Storm-0940利用ARTEX攻击ConnectWise
微软称，中国关联组织Storm-0940利用智能体框架ARTEX和被盗的ConnectWise应用凭据，在未获授权访问ConnectWise Cloud Backup后针对Microsoft 365租户发起攻击。Storm-0940尝试登录超过2,250个租户，Huntress确认162个租户出现未授权登录，随后在近1,000个Entra租户中发现登录活动，其中超过300次尝试成功；大部分密码喷洒尝试均告失败。ConnectWise表示，目前没有迹象显示备份数据遭到入侵。
这起事件显示，AI智能体结合被盗的多租户应用凭据后，能够以极快速度自动执行侦察和登录尝试，令安全团队难以及时发现和响应。
Microsoft says a China-aligned hacking group used AI agents to breach ConnectWise’s Cloud Backup service, opening a route into customers’ Microsoft 365 accounts.
Microsoft Threat Intelligence published its findings on Storm-0940 on October 21. ConnectWise disclosed the breach in a security advisory on October 16, the same day security firm Huntress published its initial account of the attack.
ConnectWise Cloud Backup, previously known as SkyKick, allows IT service providers to back up clients’ Microsoft 365 data. The service relies on applications with broad access to customer accounts, making those app identities a potential route into connected systems.
#Microsoft#ConnectWise#ARTEX#Storm-0940#Microsoft 365#ConnectWise Cloud Backup#Huntress