China-Linked Hackers Leverage AI to Breach 2,250 Microsoft Tenants via ConnectWise

Network administrators and IT security teams across the United States face new pressure to monitor their Microsoft 365 environments after a massive supply chain attack disrupted operations. The incident involves a China-state-aligned group that exploited unauthorized access to ConnectWise, a multi-tenant application, to launch automated sign-in attempts against more than 2,250 Microsoft 365 tenants. For organizations relying on these cloud services, the breach introduces immediate risks related to identity management and potential data exposure, requiring urgent verification of application credentials and user activity logs.

Microsoft detailed the attack on its security blog, identifying the perpetrator as Storm-0940, a group active since 2021 with no known industry aliases. The attackers utilized ARTEX, an open-source agentic AI penetration testing framework, to accelerate reconnaissance and password spraying. This system employs large language model-driven agents to perform autonomous tests with minimal human interaction, allowing the group to operate continuously and reduce the time available for defenders to detect anomalies. The use of stolen ConnectWise application credentials enabled the attackers to authenticate without interactive user sign-ins, bypassing standard user authentication checks.

The scale of the automated password guessing was significant, targeting 327 accounts across eight organizations with over 151,000 failed logons, none of which succeeded. At its peak on October 11, the campaign generated 2,900 attempts per minute, resulting in more than 111,000 failures that day. Although nearly 98% of these activities were locked out, the control of multiple ConnectWise cloud app identities allowed the AI agents to sign into customer tenants from the same IP range. In under four minutes, the attackers executed more than 200 sign-ins using just four application credentials, demonstrating the speed at which the automated framework could traverse the network.

Once inside tenant environments, the attackers performed directory operations, reconnaissance, and changes to app credentials, identities, and privileged roles. In one specific instance on October 15, security firm Huntress observed an application adding itself to the top administrator role, a behavior that triggered specific alerts in Microsoft Defender. This unauthorized action included planting new secrets set to expire in 2028. By October 16, Huntress had confirmed unauthorized sign-ins for 162 tenants. The following day, nearly 1,000 Entra tenants showed sign-in activity from the attacking IP, with more than 300 of those sign-ins succeeding. The sequential nature of the sweep, with attacks occurring seconds apart in sorted order, indicated the use of a script working from a predefined target list.

The targeted industries included aerospace and defense, semiconductor manufacturing, government agencies, and think tanks, with 14 industries listed in total. Microsoft clarified that the activity did not stem from a vulnerability in its own systems or products, but rather from the compromise of the third-party ConnectWise application. The deployment of ARTEX marks a shift in attack methodology, as threat actors in multiple regions are adopting this technology. Public reporting this month also linked the framework to breaches at South Korean financial institutions, where a suspect likely based in China allegedly used ARTEX with Anthropic’s Claude Code model.

In response to the incident, ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services as a precautionary measure. The company has begun a phased restoration process, with full recovery expected to take several days. To date, ConnectWise has no indicators that partner backup data was compromised. The developer of ARTEX, known by the handle Autumn-27, announced on GitHub that the project would cease updates and transition to closed source, according to Reuters. This development may impact how other threat actors utilize the tool in future campaigns.

Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued. Security teams are urged to review activity logs from this month to identify any unauthorized sign-ins or changes to privileged roles. While a successful sign-in or affected app connection does not guarantee that data was accessed or exfiltrated, the rapid pace of the attack underscores the need for enhanced monitoring of automated authentication processes. The incident highlights the growing efficacy of AI-driven agents in executing complex supply chain attacks with minimal human oversight.