Microsoft says hackers aimed AI agents at over 2,250 company Microsoft 365 accounts. Most attempts failed, but some won privileged access.
Microsoft says China-linked attackers it tracks as Storm-0940 used compromised app sign-in credentials from IT management vendor ConnectWise, The Register reported on 22 October.
Those credentials carried permissions customers had already granted to ConnectWise services. No user had to log in.
With ARTEX, a freely available open source AI tool for penetration testing, the attackers tried to sign in to more than 2,250 Microsoft 365 tenants, at times 2,900 attempts a minute. In some cases they went from picking a target to privileged access, meaning higher-level permissions, in under three hours.
Microsoft has not said how many customers were compromised or whether data was taken. It cautioned that a successful login does not necessarily mean information was accessed.
ConnectWise CEO Manny Rivelo said the company had contained the affected application connections and was gradually restoring services. ConnectWise had shut down three of its cloud services after finding the access.
Our reading: the attackers did not need a user to log in. They used access customers had already granted to a trusted vendor's app.
Sources
Our file on Microsoft
- 24 Oct
Microsoft dropped Publisher this month, and Word cannot open its files directly. Updates start removing it from some Microsoft 365 PCs mid-November.
- 23 Oct
Microsoft, Oracle and 3 peers have $2.7 trillion in AI commitments, a study found. None is on balance sheets yet.
- 23 Oct
OpenAI said its models will reach 3 clouds in the coming weeks. Procurement teams check whether terms differ.
- 22 Oct
Microsoft added new controls for European cloud customers. A Gartner analyst said he "would not call this complete control."
- 20 Oct
ValueLicensing sued Microsoft for £270m. A court refused Microsoft's bid to appeal.
For your next steering committee
- 1Ask which AI tools already touch your ERP or finance data, including the ones nobody approved.
- 2Ask what each tool is allowed to change, and who reviews what it changed.
- 3Ask how the result is measured, and who decides to switch a tool off.
Issue 01 of the ERP LEADERS brief puts a timeline, the three-number review and six questions on one page. Read issue 01
Welcome back. · Issue 01
