AI Agents Shrink Defender Window in 2,250 Tenant ConnectWise Breach

Autonomous software agents have compressed the window for defenders to detect and stop a supply chain intrusion. Microsoft attributes a large-scale attack on ConnectWise applications to Storm-0940, a China-state-aligned threat actor. The group utilized an open-source framework called ARTEX to accelerate reconnaissance and credential abuse across the cloud.

The attackers compromised a multi-tenant ConnectWise application and attempted sign-ins at more than 2,250 Microsoft 365 tenants. In some instances, the intrusions reached privileged access levels less than three hours after initial targeting. The operation relied on stolen credentials belonging to ConnectWise apps, allowing the attackers to authenticate without interactive user sign-in.

Microsoft describes ARTEX as a system of LLM-driven agents that run autonomous penetration tests. The tool sped up scanning, password spraying, and the abuse of OAuth applications. These agents operate continuously with minimal human involvement, reducing the time available for security teams to identify anomalies.

Storm-0940 has been active since 2021 and targets fourteen industries. Sectors include aerospace and defense, semiconductors, government, and think tanks. A parallel password-spraying campaign hit 327 accounts across eight organizations. The effort produced more than 151,000 failed logons, with no successes recorded.

The peak of the spray occurred on October 11, reaching 2,900 attempts per minute. That day logged more than 111,000 failures, with 48 accounts each experiencing over 1,000 rejections. Nearly 98% of the activity resulted in lockouts. The identity takeover of ConnectWise cloud apps proved more effective than the spraying attempts.

Using four application credentials, the AI agents signed into customer tenants from the same IP range. They recorded more than 200 sign-ins in under four minutes. Within some tenants, the agents performed Graph and directory operations, changed app credentials, and modified privileged roles. They moved through tenants in sorted order, seconds apart, suggesting scripted execution from a target list.

Security firm Huntress observed one tenant on October 15 where an app added itself to the Global Administrator role. The attackers planted new secrets set to expire in 2028. By October 16, Huntress confirmed unauthorized sign-ins at 162 tenants. A day later, it counted almost 1,000 Entra tenants with sign-in activity from the attacking IP, with more than 300 successful.

ConnectWise detected the unauthorized access and suspended Cloud Backup, SaaS Security, and Cloud Management. The company has begun a phased restoration expected to take several days. It reports no indicators that partner backup data was compromised. Microsoft advised customers to keep affected app connections disabled until formal restoration instructions are issued.