China-linked hackers use AI tools to breach 2,250 Microsoft tenants via ConnectWise

A new wave of cyberattacks has exposed the growing speed and scale of automated threats, as a China-aligned hacking group used artificial intelligence to compromise thousands of business tenants in just hours. The operation, attributed to the actor known as Storm-0940, targeted the ConnectWise platform and subsequently launched sign-in attempts at over 2,250 Microsoft 365 tenants. This incident marks a significant shift in how supply chain vulnerabilities are exploited, with attackers reaching privileged access levels in less than three hours on some occasions.

The core of the operation relied on ARTEX, an open-source framework that drives autonomous penetration testing using large language models. Microsoft reported that this technology allowed the attackers to automate scanning, reconnaissance, and password spraying with minimal human intervention. The system operated continuously, creating a pace of attack that left defenders with little time to detect or respond to the intrusion. This automation enabled the group to move from initial access to deep system operations with unusual speed.

Beyond the primary supply chain vector, the attackers conducted massive password spraying campaigns against 327 accounts across eight organizations. These efforts generated more than 151,000 failed logon attempts, with 98% of the activity resulting in account lockouts. At the peak of the campaign on October 11, the system made 2,900 attempts per minute, with over 111,000 failures recorded in a single day. While these brute-force methods largely failed, they served to distract defenders while the AI agents focused on the more effective application credential abuse.

The most damaging phase of the attack involved the use of stolen ConnectWise application credentials to sign in to customer tenants. Because these sign-ins did not require interactive user login, they bypassed many standard security checks. In one instance, the agents executed more than 200 sign-ins in under four minutes using just four application credentials. Within affected tenants, the attackers performed directory operations, changed application credentials, and modified privileged roles and group memberships to solidify their control.

Security firm Huntress provided additional visibility into the attack timeline, confirming unauthorized sign-ins for 162 tenants by October 16. By the following day, nearly 1,000 Entra tenants showed sign-in activity from the attacking IP range, with more than 300 of those sign-ins succeeding. In one specific tenant, the attackers added an application to the top administrator role, a behavior that triggered alerts from Microsoft Defender. They also planted new secrets configured to expire in 2028, indicating a long-term persistence strategy.

Storm-0940 has been active since 2021 and is characterized as a China-state-aligned actor with no known industry aliases. The group targeted 14 specific organizations, including those in aerospace, defense, semiconductor, government, and think tank sectors. Microsoft clarified that the attack did not stem from a vulnerability in its own systems or products, but rather from the unauthorized access to the multi-tenant ConnectWise application. The systematic, sorted-order sweep through tenants suggested the use of a script working from a pre-defined target list.

The use of ARTEX highlights a broader trend in cybercrime, as threat actors in various regions adopt similar AI-driven tools. Public reporting this month linked the framework to breaches at South Korean financial institutions, where the suspect was likely based in China and allegedly used the tool with Anthropic's Claude Code. The developer of ARTEX, known by the handle Autumn-27, announced that the project would no longer be updated and would become closed source, a move that may impact the open-source security community.

In response to the incident, ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services as a precautionary measure. The company has begun a phased restoration process, with recovery expected to take several days. So far, there are no indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review recent activity logs to identify any potential exposure.

Outlook for organizations affected by the attack suggests a need for heightened scrutiny of application credentials and automated sign-ins. While a successful sign-in does not guarantee data exfiltration, the speed of the AI-driven attack underscores the need for faster detection mechanisms. As autonomous agents become more prevalent in the hands of threat actors, defenders must adapt their strategies to match the pace of these new, self-directed threats.