Microsoft has revealed that a cyberattack linked to China, orchestrated by a group identified as Storm-0940, targeted the ConnectWise Cloud Backup application in a recent supply chain assault. This attack marks the latest instance of state-aligned cyber threats leveraging advanced technologies to compromise global organizations.
AI Tools Enhance Attack Speed and Efficiency
Storm-0940 utilized ARTEX, an AI-driven tool initially designed for penetration testing, to automate various stages of the attack. This tool, once closed-source due to misuse, enabled rapid scanning, reconnaissance, and password spraying activities, directly impacting a wide range of sectors including aerospace, defense, and financial services.
The use of ARTEX allowed the attackers to bypass traditional security measures by automating tasks at what Microsoft describes as “machine speed.” This approach facilitated seamless access to target environments, leveraging existing OAuth permissions without the need for user interaction.
Widespread Impact on Global Organizations
According to Microsoft, Storm-0940’s tactics have been in play since at least 2021. The group has been known to exploit internet-facing applications to gain initial access, subsequently using compromised accounts for lateral movement within targeted networks. The ARTEX-enabled attacks have led to privileged access in numerous cases, with some breaches occurring in under three hours from initial targeting.
The ConnectWise incident saw the hackers attempt more than 2,250 logins per minute across multiple tenants, overwhelming security defenses. Over a short period, Microsoft logged over 151,000 failed login attempts, highlighting the challenge of detecting and responding to such high-speed attacks.
Response and Future Implications
ConnectWise has acknowledged the scale of the attack, emphasizing the broader implications for the software supply chain. Nation-state actors are increasingly targeting trusted connections within supply chains, exploiting vulnerabilities to access multiple organizations through a single breach.
To mitigate these threats, ConnectWise temporarily suspended services and is gradually restoring them. This incident underscores the need for robust defenses, particularly for Managed Service Providers (MSPs), which often serve as gateways to numerous client systems.
As cyber threats evolve, the integration of AI tools into offensive strategies poses a significant challenge for cybersecurity. Organizations must enhance their defenses to counteract these sophisticated attacks, ensuring comprehensive protection across their supply chains.
