AI Agents: Microsoft Blames Chinese Group for ConnectWise Breach
Storm-0940 used the ARTEX framework to breach thousands of Microsoft 365 tenants via ConnectWise, achieving privileged access in under three hours.
By Harper Laurent ·
Microsoft has identified a China-state-aligned threat actor named Storm-0940 as the group behind a massive supply chain attack on ConnectWise. The company stated that the intruders utilized an open-source artificial intelligence framework called ARTEX to execute the breach. This tool allowed the attackers to move through the system with a speed that left defenders with minimal reaction time. The incident involved unauthorized access to a multi-tenant ConnectWise application, which served as the entry point for the wider campaign.
The attackers leveraged stolen credentials belonging to ConnectWise applications to authenticate as those apps. This method eliminated the need for interactive user sign-ins, allowing the AI agents to operate autonomously. Microsoft reported that the group attempted sign-ins at more than 2,250 Microsoft 365 tenants. In some instances, the intruders reached privileged access levels less than three hours after the initial targeting began. The framework sped up scanning, reconnaissance, and password spraying activities.
Storm-0940 has been active since 2021 and operates without known industry aliases. Microsoft listed 14 targeted sectors for this campaign, including aerospace, defense, semiconductors, government, and think tanks. The company emphasized that the attack did not originate from a vulnerability in its own systems or products. Instead, the breach relied on the compromise of third-party application credentials. The use of LLM-driven agents enabled the group to conduct continuous operations with little human oversight.
A separate password-spraying effort targeted 327 accounts across eight organizations. This activity generated more than 151,000 failed logons, with no successful sign-ins recorded. At its peak on October 11, the spray reached 2,900 attempts per minute. More than 111,000 failures occurred on that single day, with 48 accounts logging over 1,000 failures each. Nearly 98% of this activity resulted in account lockouts, indicating a brute-force approach that was largely thwarted.
The identity takeover of ConnectWise cloud apps proved more effective than the password spray. Using four application credentials, the AI agents signed into customer tenants from the same IP range. They recorded more than 200 sign-ins in under four minutes. Within these tenants, the agents performed Graph and directory operations and changed app credentials, identities, and privileged roles. The attackers moved through tenants in sorted order, often seconds apart, a pattern suggesting a script working from a target list.
Security firm Huntress observed one tenant on October 15 where an app added itself to the Global Administrator role. This behavior triggered a Microsoft Defender alert for application self-assignment of that role. The attackers planted new secrets set to expire in 2028. By October 16, Huntress confirmed unauthorized sign-ins at 162 tenants. A day later, the firm counted almost 1,000 Entra tenants with sign-in activity from the attacking IP, with more than 300 of those sign-ins being successful.
The deployment of ARTEX distinguishes this campaign from many traditional attacks. The framework can work with any AI model, and public reporting this month linked it to breaches at South Korean financial institutions. CrowdStrike noted that the suspect in those separate attacks was likely based in China and allegedly used ARTEX with Anthropic’s Claude Code. Reuters reported that ARTEX’s developer, identified as Autumn-27, stated on GitHub that the project will no longer be updated and would become closed source.
ConnectWise detected the unauthorized access and suspended Cloud Backup, SaaS Security, and Cloud Management as a precaution. The company has begun a phased restoration expected to take several days. It reports no indicators that partner backup data was compromised. Microsoft advised customers to keep affected app connections disabled until formal restoration instructions are issued. The company also recommended reviewing activity from this month where logs permit, noting that a successful sign-in does not necessarily mean data was accessed or taken.
