AI agents speed up major cloud breach

Businesses using Microsoft 365 face new risks after a major supply chain attack involving ConnectWise software. Microsoft confirmed on Thursday that a China-aligned threat group named Storm-0940 exploited this connection to probe more than 2,250 organizational tenants. Some attackers reached privileged access levels in under three hours, leaving many companies with little time to react.

The operation relied on stolen credentials for ConnectWise applications. This allowed the attackers to sign in as the software itself without needing user passwords. Microsoft identified the tool as ARTEX, an open-source framework that uses AI agents to run autonomous penetration tests. These agents accelerated scanning, password spraying, and the abuse of authentication protocols.

Storm-0940 has been active since 2021 and targets specific industries. This campaign hit sectors including aerospace, defense, semiconductors, and government agencies. The group is part of a broader pattern of attacks using similar tools. Recent reports linked the same framework to breaches at financial institutions in South Korea, where attackers allegedly used the AI model Claude Code.

A separate password-spraying effort tested 327 accounts across eight organizations. This produced over 151,000 failed logins, with a peak rate of 2,900 attempts per minute on October 11. Almost 98 percent of these attempts resulted in account lockouts. The lack of success in this phase contrasts with the effectiveness of the application takeover method.

The identity takeover of ConnectWise cloud apps proved more damaging. Using four application credentials, the AI agents recorded over 200 sign-ins in under four minutes from the same IP range. Within some tenants, they changed roles, groups, and credentials. Security firm Huntress noted that one tenant saw an app add itself to the Global Administrator role on October 15.

By October 16, Huntress confirmed unauthorized sign-ins at 162 tenants. A day later, the count rose to nearly 1,000 tenants with activity from the attacking IP. More than 300 of these sign-ins were successful. The attackers moved through the target list in sorted order, with seconds between actions, suggesting a scripted approach.

ConnectWise detected the issue and suspended several services, including Cloud Backup and SaaS Security. The company expects restoration to take several days and reports no signs that partner backup data was compromised. Microsoft advised customers to keep affected app connections disabled until further notice and to review recent logs for any unusual activity.