Microsoft says hackers used an AI attack tool on ConnectWise and reached cloud accounts in under 3 hours

Microsoft says a China-aligned group it calls Storm-0940 used ARTEX, an AI penetration-testing framework, to attack hundreds of organisations from September. In several cases it went from first target to privileged cloud access in under three hours. Microsoft links the group to the ConnectWise compromise and says the attackers abused apps already trusted by Microsoft 365 accounts, with no flaw in Microsoft's own systems.

• Ask your IT support firm or managed provider in writing whether they use ConnectWise, and whether they have followed ConnectWise's published containment guidance.
• If you run Microsoft 365, ask whoever administers it to review which third-party apps have access and any recent credential or permission changes on them.

Source: Microsoft Security Blog. This is our short summary of their reporting. The paragraphs marked "Our read" and the things to do are SeedFoundry's opinion. The summary is drafted with AI tools. Image: Microsoft Security Blog, from its own announcement. How we source and credit