‘Agents are not constrained by factors affecting humans – they can work around the clock, on weekends, and on holidays and attempt multiple breach paths simultaneously,’ says Microsoft.
Microsoft said the China state-aligned group Storm-0940 used agentic AI to launch 2,900 sign-in attempts per minute on Microsoft tenants in the ConnectWise Cloud Backup breach.
“Microsoft assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multi-tenant application,” said Microsoft in a security research blog on the “AI-Driven Large-Scale Nation State” attack. “This activity demonstrates how threat actors are integrating agentic AI into existing offensive security workflows and allows them to scale their operations exponentially.”
Agents are “not constrained by factors affecting humans – they can work around the clock, on weekends, and on holidays and attempt multiple breach paths simultaneously enabling significantly reduced time from selecting a target to achieving objectives, increasing the speed and impact of complex attacks like supply chain compromises,” said Microsoft.
Dustin Bolander, an MSP and serial entrepreneur who is a partner and CEO of CyberDrain, a Microsoft 365 management platform, said the speed at which bad actors are moving with agentic AI has removed “any margin of error” for MSPs who are not well-versed in security fundamentals.
“Years ago when AI was not in use as it is today you could make some mistakes and still get by on luck in a lot of cases as an MSP,” said Bolander. “Now the hackers are using AI and moving 1,000 times faster!”
Microsoft said Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks, targeting hundreds of organizations globally across a broad range of industries.
“Storm-0940’s use of ARTEX accelerated the speed of compromised application abuse to authenticate to Microsoft 365 customer environments through applications that had already been granted access,” said Microsoft. “This allowed the threat actor to operate without requiring an interactive user sign-in.”
Microsoft said Storm-0940 attempted to access more than 2,250 Microsoft 365 customer tenants through compromised ConnectWise application credentials, but did not disclose the total number of tenants successfully compromised.
Threat researcher Huntress has reported that it had seen threat activity involving ConnectWise Cloud Backup and Cloud Management applications with sign-in activity from the “malicious infrastructure” across more than 1,000 Microsoft tenants, “more than 300 of which appeared to succeed,” said Huntress Principal Security Operations Analyst Jonathan Semon. That said, he cautioned that in some of those 300 cases the application was not present so “success” does not always mean “access,” he said.
Microsoft said Storm-0940’s use of the ARTEX framework did not result from a compromise of or a vulnerability in Microsoft corporate systems, products, or services.
ConnectWise is aiming by the end of this week to provide thousands of its MSPs with access once again to ConnectWise Cloud Backup for Microsoft 365 and other services that were suspended on October 17 in the wake of the security breach, said ConnectWise Chief Technology Officer David Raissipour.
ConnectWise shut down access to ConnectWise Cloud Backup, SaaS Security and Cloud Management for thousands of MSPs as part of its response to a breach of Cloud Backup, formerly SkyKick. That shutdown came after ConnectWise learned Cloud Backup had been compromised and was being used to gain unauthorized access to Microsoft 365 tenants.
As for the potential data exfiltration impact on MSP Microsoft 365 tenants, Raissipour said ConnectWise is continuing a full-court press offensive to work with its MSPs to see if there was any “access to data” from Microsoft 365 tenants.
Microsoft said Storm-0940 has been active since 2021 and targets organizations across multiple industries for data theft.
“In cloud environments, the actor has also established persistence by adding credentials to existing OAuth applications, allowing continued access to Microsoft 365 resources,” Microsoft said. “The actor has used these applications to access and exfiltrate email and other data through Microsoft Graph.”
ConnectWise has been running tutorial sessions and webinars every two hours, 24 hours a day, seven days a week, to help partners determine indicators of compromise (IOCs) in Microsoft 365 tenants.
“Our security organization is walking MSPs step-by-step how to go into (Microsoft) Entra ID and look for indications of compromise and elevated privileges,” said Raissipour. “We’ve done this now for literally thousands of partners.”
Microsoft said the “application credential modification” made by Storm-0940’s associated agents in the “targeted victims’ environments can lead to persistence through other identities, credentials, and cloud services.”
In fact, Microsoft said those changes can “remain active as a backdoor” for the bad actors even after the “original compromised application is mediated.”
Bolander, who is also founder and CEO of Austin, Texas-based MSP Clear Guidance Partners and Beltex, an MSP cybersecurity insurance provider, said he believes Storm-0940 is still lurking in many customer environments. “There are breached tenants that don’t realize it yet,” he said. “We are never going to know how many Microsoft tenants were breached.”
Bolander said MSPs that are claiming to be able to provide robust client management, monitoring and security for customers at a cost of $125 per client are doing the industry a disservice.
“Security is deficient at that point,” he said. “There is not enough money in that $125 per client number. MSPs cutting corners on security or selling on price are hurting the MSP industry and the clients. You can’t have a good security foundation at $125 per client. You are making mistakes left and right.”
