Microsoft details AI-driven breach via ConnectWise affecting 2,250 tenants

Microsoft disclosed on its security blog that Storm-0940, a China-state-aligned threat actor, utilized an open-source artificial intelligence framework in a widespread supply chain attack. The group exploited unauthorized access to the multi-tenant ConnectWise application to attempt sign-ins at more than 2,250 Microsoft 365 tenants. By using stolen credentials for the ConnectWise app, the attackers authenticated without requiring interactive user login. In several instances, the operation achieved privileged access within three hours of initial targeting.

The campaign relied on ARTEX, a system of large language model-driven agents designed to run autonomous penetration tests. This tool accelerated scanning, reconnaissance, and OAuth application abuse. The agents operated continuously with minimal human intervention, creating a pace that left defenders with limited time to detect and respond. The group also conducted automated password spraying, targeting 327 accounts across eight organizations. This resulted in more than 151,000 failed logons, though no successful logins were recorded from this specific method. It remains unclear how the initial ConnectWise credentials were stolen or the exact number of tenants that were ultimately compromised.

Storm-0940 has been active since 2021 and is described as having no known industry aliases. The targets included sectors such as aerospace and defense, semiconductors, government, and think tanks, with 14 industries listed in total. Microsoft clarified that the activity did not stem from a vulnerability in its own systems or products. At its peak on October 11, the password spray activity reached 2,900 attempts per minute, totaling over 111,000 for the day. Nearly 98% of these attempts were locked out, but the attackers leveraged the stolen app identities to sign into customer tenants from the same IP range.

Using four application credentials, the agents executed more than 200 sign-ins in under four minutes. Within affected tenants, the group performed graph and directory operations, changed app credentials, and modified identities, groups, and privileged roles. Huntress, a security firm, observed an app adding itself to the top administrator role in one tenant on October 15. This action triggered a Microsoft Defender alert for an application self-assigning a Global Administrator role. The attackers also planted new secrets set to expire in 2028. By October 16, Huntress confirmed unauthorized sign-ins for 162 tenants. The following day, almost 1,000 Entra tenants showed sign-in activity from the attacking IP, with over 300 succeeding. The sequential sweep of tenants suggested a script working from a target list.

The use of ARTEX distinguishes this attack from many traditional methods. Microsoft notes the framework can utilize any AI model. Threat actors in various regions are adopting this technology, and recent reports linked it to breaches at South Korean financial institutions. CrowdStrike indicated the suspect in those separate cases was likely based in China and may have used ARTEX with Anthropic’s Claude Code. The developer of ARTEX, known online as Autumn-27, announced on GitHub that the project will no longer be updated and will transition to closed source, according to Reuters.

ConnectWise acknowledged the unauthorized access and suspended its Cloud Backup, SaaS Security, and Cloud Management services as a precaution. The company has initiated a phased restoration process, with recovery expected to take several days. It currently has no indicators that partner backup data was compromised. Microsoft advises that an affected app or successful sign-in does not guarantee data was accessed or taken. Customers are urged to keep affected app connections disabled until formal restoration instructions are issued and to review activity logs from this month where available.