China-linked hackers used agentic AI in attack on 2,250 Microsoft 365 tenants
Summary
A China-state-aligned threat actor, Storm-0940, compromised a ConnectWise cloud backup application and utilized an open-source agentic AI framework called ARTEX to attack over 2,250 Microsoft 365 tenants. The attackers exploited stolen credentials to automate sign-ins at an extremely high rate, bypassing traditional interactive user authentication and performing reconnaissance and persistence operations within compromised environments.
IFF Assessment
This article describes an advanced cyberattack utilizing AI to scale operations and achieve rapid compromise, representing a significant threat to defenders.
Defender Context
This incident highlights the escalating use of AI by threat actors to automate and accelerate attacks, making traditional security monitoring and response times insufficient. Defenders need to focus on detecting anomalous, high-volume sign-in activity, especially from third-party integrations, and be prepared for sophisticated persistence techniques that can survive initial remediation.