Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants
Storm-0940, a China-aligned espionage group, exploited the ConnectWise security incident using ARTEX, an open-source AI framework that automates reconnaissance, vulnerability discovery, credential attacks, and data theft. Attacks began in September 2025 targeting government agencies, defense contractors, banks, manufacturers, and tech firms. Between October 10-14, a specific campaign wave demonstrated how AI-assisted attacks can accelerate from initial compromise to cloud privilege escalation.
Key points
- AI penetration-testing framework automated vulnerability discovery and exploitation
- Average time from target selection to privileged access under three hours
- Targeted 2,250+ Microsoft 365 tenants across critical sectors
Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. The Register did the reporting; read the original for the full story.
Read the full story at The Register
