Conversation

🏆 New Achievement! Rise of the Machines, Re: Your Employment Status!

This memo is to formally welcome Storm-0940 back from extended leave. During your absence, you breached a ConnectWise cloud backup application, borrowed its credential set, and leveraged the open-source ARTEX agentic AI framework to hammer over 2,250 Microsoft 365 tenants at 2,900 sign-in attempts per minute. Automation has really streamlined your workflow — HR is impressed, albeit posthumously. (1/3)

Microsoft Threat Intelligence has attributed this activity to the China-state-aligned threat actor and confirms no Microsoft systems were themselves compromised. ConnectWise identities were simply reanimated and walked right into tenants that had already granted them access. The Sixth Sense called: these apps didn't know they were dead. (2/3)