China-Linked Group Leverages AI Agents in Massive ConnectWise Breach

A China-aligned hacking group has deployed autonomous AI agents to execute one of the most rapid and wide-reaching supply chain attacks seen in recent enterprise security history. According to Microsoft’s Security blog, the actor known as Storm-0940 leveraged ARTEX, an open-source agentic AI penetration testing framework, to breach the multi-tenant application ConnectWise. Once unauthorized access was established, the group attempted sign-ins at more than 2,250 Microsoft 365 tenants, using stolen ConnectWise application credentials that authenticated without requiring interactive user sign-ins. In some cases, the attackers reached privileged access levels in under three hours after initially targeting a specific environment.

The operation relied heavily on automated password guessing, specifically a technique known as password spraying. This method targeted 327 accounts across eight organizations, resulting in more than 151,000 failed logon attempts without a single success. The integration of ARTEX, described as a system of large language model-driven agents that run autonomous penetration tests, significantly accelerated scanning, reconnaissance, and OAuth application abuse. These agents operated with minimal human interaction, working around the clock at a pace that left defenders with little time to detect and respond to the intrusion.

Storm-0940, an actor active since 2021, is designated as a China-state-aligned group with no known industry aliases. The name follows a convention typically used for developing threat actors. The attack focused on specific sectors, including aerospace and defense, semiconductors, government entities, and think tanks, with 14 industries listed in total. Microsoft clarified that the activity did not stem from a compromise or vulnerability within its own systems, products, or services. It remains uncertain exactly how the ConnectWise credentials were initially stolen or how many tenants were definitively compromised.

The intensity of the attack peaked on October 11, when the password spray campaign generated 2,900 attempts per minute, all of which failed. That single day saw over 111,000 failed attempts, with 48 accounts logging more than 1,000 failures each. Nearly 98% of this activity resulted in account lockouts. However, by controlling the identities of multiple ConnectWise cloud apps, the AI agents signed into customer tenants from the same IP range using those apps' credentials. In one instance, more than 200 sign-ins were executed in under four minutes using just four application credentials. Within affected tenants, the agents performed Graph and directory operations, conducted reconnaissance, and modified app credentials, identities, groups, and privileged roles.

On October 15, Huntress, a security firm, observed an app adding itself to the top administrator role in one tenant, a behavior that triggered a Microsoft Defender alert for an application self-assigning a Global Administrator role. The attackers also planted new secrets set to expire in 2028. By October 16, Huntress confirmed unauthorized sign-ins for 162 tenants. A day later, the count rose to nearly 1,000 Entra tenants showing sign-in activity from the attacking IP, with more than 300 of those sign-ins succeeding. The systematic sweep through tenants, occurring in sorted order just seconds apart, indicated a script working from a predefined target list.

The use of ARTEX distinguishes this campaign from many traditional attacks. Microsoft noted that the framework can utilize any AI model, and threat actors in multiple regions are currently employing the technology. Public reporting this month linked the framework to breaches at South Korean financial institutions. CrowdStrike stated that the suspect in those separate attacks was likely based in China and allegedly used ARTEX with Anthropic’s Claude Code. In response to the widespread use, ARTEX’s developer, identified by the handle Autumn-27, announced on GitHub that the project would no longer be updated and would transition to closed source, according to Reuters.

ConnectWise acknowledged the unauthorized access and suspended its Cloud Backup, SaaS Security, and Cloud Management services as a precautionary measure. The company has initiated a phased restoration process, with full recovery expected to take several days. To date, there are no indicators that partner backup data was compromised. Microsoft advises customers that an affected app or successful sign-in does not necessarily mean data was accessed or exfiltrated. It recommends keeping affected app connections disabled until formal restoration instructions are issued and reviewing activity from this month where logs permit.