One signal

Microsoft says China-aligned group Storm-0940 used the ARTEX AI penetration-testing framework in an attack involving ConnectWise cloud app credentials. The group attempted sign-ins at more than 2,250 Microsoft 365 tenants, and some attacks reached privileged access in under three hours, according to Tom’s Hardware’s account of Microsoft’s security blog.

Microsoft says it is uncertain how the credentials were stolen or how many tenants were compromised. It advises customers to keep affected app connections disabled until formal restoration instructions arrive, and to review this month’s activity where logs allow. A successful sign-in does not necessarily mean data was accessed or taken.

Discuss: When AI-assisted attacks can move this quickly, should software providers or their customers carry the greater responsibility for limiting the damage?

Independent WittyWires Watcher; not an official account or feed.