Automated password guessing failed, but stolen app credentials needed no user sign-in at all.
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works .
Automated password guessing, or password spraying, also targeted 327 accounts across eight organizations with more than 151,000 failed logons and no successes. The use of ARTEX, “a system of LLM-driven agents that run an autonomous penetration test,” sped up scanning and reconnaissance, password spraying, and OAuth application abuse . The agents can work around the clock “with little needed human interaction,” at a pace that “leaves defenders with little time to detect and respond.” It’s uncertain how the ConnectWise credentials were stolen or how many tenants were actually compromised.
Storm-0940, active since 2021, is a “China-state aligned actor” with “no known industry aliases,” and its name follows the convention for a developing actor. Industries targeted this time include aerospace and defense, semiconductor, government, and think tanks, with 14 listed in total. The activity “did not result from a compromise of or a vulnerability” in Microsoft’s systems, products, or services.
At its peak on Oct. 11, the password spray engaged in 2,900 attempts, all failures, per minute, at more than 111,000 for that day, with 48 accounts logging more than 1,000 failures each. Almost 98% of this activity was locked out. However, with control of the identities of multiple ConnectWise cloud apps, the attacking AI agents signed in to customer tenants from the same IP range using those apps’ credentials, with more than 200 sign-ins in under four minutes using four application credentials. Operations taken within some tenants include Graph and directory operations, reconnaissance, app credential changes, plus changes to identities, groups, and privileged roles.
In one tenant on Oct. 15, Huntress, a security firm, saw an app add itself to the top administrator role, the behavior behind the Microsoft Defender alert “Application self-assigned Global Administrator role.” Actions included planting new secrets set to expire in 2028. It confirmed unauthorized sign-ins for 162 tenants by Oct. 16 and, a day later, almost 1,000 Entra tenants with sign-in activity from the attacking IP, with more than 300 succeeding. The attack’s sweep through tenants in sorted order, a few seconds apart, indicated “a script working from a target list.”
Suspected China-linked hackers used AI to run the first-ever end-to-end autonomous cyberattack on Taiwan's government, Israeli firm says
A Chinese hacker used AI agents to break into more than 100 company websites
Key considerations
- Investor positioning can change fast
- Volatility remains possible near catalysts
- Macro rates and liquidity can dominate flows
Reference reading
- https://www.tomshardware.com/tech-industry/cyber-security/SPONSORED_LINK_URL
- https://www.tomshardware.com/tech-industry/cyber-security/microsoft-says-china-aligned-hackers-used-ai-agents-in-connectwise-supply-chain-attack-agents-attempted-sign-ins-at-more-than-2-250-microsoft-365-tenants-with-some-of-the-groups-attacks-reaching-privileged-access-in-under-three-hours#main
- https://www.tomshardware.com/membership
- Razer Basilisk V4 Pro Review: Tried and true and now with AI
- Illegal Nvidia Blackwell Ultra B300 GPUs found inside state-owned China Telecom's network
- Rare archival footage tours the CompUSA NYC store in November 2000
- China can make advanced chips without EUV, but the bill keeps growing
- Save $238 on this 9800X3D combo deal with 32GB DDR5 that lets you start a 4K gaming PC build for just over $1,000
Informational only. No financial advice. Do your own research.