AI-Driven Intrusion: Hackers Breach ConnectWise to Target 2,250 Microsoft Tenants

Major technology companies are increasingly facing threats from automated systems that can act faster than human defenders. Microsoft recently detailed a significant supply chain attack where a group linked to China used artificial intelligence agents to infiltrate thousands of organizations through a third-party platform.

The actor, identified by Microsoft as Storm-0940, leveraged an open-source penetration testing framework called ARTEX to launch a broad offensive against ConnectWise. Once the group gained unauthorized access to this multi-tenant application, they used stolen credentials to attempt sign-ins at more than 2,250 distinct Microsoft 365 tenants. These attempts did not require interactive user logins, allowing the automated agents to authenticate as the applications themselves. In several cases, the attackers achieved privileged access within three hours of their initial targeting.

ARTEX is a system composed of large language model driven agents that conduct autonomous penetration tests. According to Microsoft, these agents accelerated the process of scanning, reconnaissance, and the abuse of OAuth applications. The system can operate continuously with minimal human input, creating a pace that leaves defenders with very little time to detect and respond to the intrusion. It remains unclear how the original ConnectWise credentials were stolen or exactly how many tenants were fully compromised.

Storm-0940 has been active since 2021 and is described as a China-state aligned actor with no known industry aliases. The current campaign targeted a diverse range of sectors, including aerospace, defense, semiconductor manufacturing, government agencies, and think tanks. Microsoft clarified that the attack was not caused by a vulnerability in its own systems or services, but rather by the compromise of a third-party application.

The automated password spraying component of the attack was intense. At its peak on October 11, the system made 2,900 attempts per minute, resulting in over 111,000 failed logons that day. While 48 accounts recorded more than 1,000 failures each and nearly 98 percent of the activity was locked out, the group also successfully used controlled ConnectWise cloud app identities. From a single IP range, the agents signed into customer tenants more than 200 times in under four minutes using just four application credentials.

Inside the compromised tenants, the agents performed directory operations, reconnaissance, and changes to app credentials, identities, and privileged roles. On October 15, the security firm Huntress observed one application adding itself to the top administrator role, a behavior that triggered a specific Microsoft Defender alert. Huntress confirmed unauthorized sign-ins for 162 tenants by October 16. By the following day, the count rose to almost 1,000 Entra tenants with activity from the attacking IP, with more than 300 of those sign-ins succeeding.

The methodical nature of the sweep, which proceeded in sorted order with seconds between actions, suggested that a script was working from a pre-defined target list. This approach differs from many traditional attacks due to the use of ARTEX, which Microsoft notes can utilize any AI model. Public reports this month have also linked the framework to breaches at South Korean financial institutions, with CrowdStrike suggesting the suspect was likely based in China and used the framework with Anthropic’s Claude Code.

In response to the development, the creator of ARTEX, known by the handle Autumn-27, announced on GitHub that the project would no longer be updated and would become closed source. ConnectWise has suspended its Cloud Backup, SaaS Security, and Cloud Management services as a precaution. The company has begun a phased restoration process, with recovery expected to take several days. There are currently no indicators that partner backup data was compromised, but Microsoft advises customers to keep affected app connections disabled until formal instructions are issued and to review recent activity logs where possible.