China-backed hackers deploy AI agents in massive ConnectWise breach affecting thousands of Microsoft tenants

A sophisticated cyber intrusion has exposed thousands of organizations to risk after a China-aligned threat group used artificial intelligence to breach a major IT service provider. Microsoft confirmed that the attack exploited stolen credentials from ConnectWise to access numerous customer environments across the United States and beyond. The incident represents a significant escalation in how automated systems are being deployed against enterprise infrastructure. Defenders are scrambling to assess the full scope of the compromise amid this fast-moving threat.

The actor, identified by Microsoft as Storm-0940, utilized ARTEX, an open-source framework for agentic AI penetration testing. This tool allowed the group to conduct autonomous reconnaissance and password guessing at a rapid pace. The attackers attempted sign-ins at more than 2,250 Microsoft 365 tenants using stolen ConnectWise application credentials. These credentials authenticated as the applications themselves, bypassing the need for interactive user logins. In several cases, the group achieved privileged access in under three hours after initial targeting.

The campaign targeted a diverse set of industries, including aerospace, defense, semiconductors, government agencies, and think tanks. Microsoft noted that fourteen specific sectors were listed in the attack data. The activity did not stem from a vulnerability in Microsoft's own systems or products. Instead, it resulted from unauthorized access to the multi-tenant ConnectWise application. The use of AI agents sped up the scanning and exploitation process, leaving defenders with limited time to detect and respond to the intrusion.

Automated password spraying also formed a key part of the attack strategy. The group targeted 327 accounts across eight organizations, resulting in more than 151,000 failed logon attempts. No successful logins were recorded during this specific phase. At its peak on October 11, the password spray generated 2,900 attempts per minute. Nearly 98% of this activity was locked out, indicating a brute-force approach against weaker credentials. However, the automated nature of the attacks allowed for high-volume testing without human intervention.

Beyond password guessing, the AI agents signed in to customer tenants using the stolen ConnectWise app credentials. More than 200 sign-ins occurred within four minutes using just four application credentials. These operations included directory changes, reconnaissance, and modifications to privileged roles. In one notable instance on October 15, a security firm named Huntress observed an app adding itself to the top administrator role. This behavior triggered a specific alert in Microsoft Defender. The attackers also planted new secrets set to expire in 2028, suggesting an intent for long-term persistence.

Huntress confirmed unauthorized sign-ins for 162 tenants by October 16. By the following day, nearly 1,000 Entra tenants showed sign-in activity from the attacking IP address. More than 300 of these attempts were successful. The sweep through tenants occurred in sorted order, with intervals of only a few seconds. This pattern indicated that a script was working from a predefined target list. The efficiency of the attack highlights the growing capability of AI-driven tools in executing complex supply chain compromises.

The ARTEX framework, developed by a user with the handle Autumn-27, is designed to run autonomous penetration tests using large language models. The developer stated on GitHub that the project would no longer be updated and would become closed source. Other threat actors in different regions have also adopted this technology. Public reports this month linked similar breaches at South Korean financial institutions to the use of ARTEX. CrowdStrike suggested the suspect in those separate attacks was likely based in China and used the tool with Anthropic's Claude Code.

ConnectWise has suspended several services, including Cloud Backup and SaaS Security, as a precautionary measure. The company has begun a phased restoration process, with recovery expected to take several days. There are currently no indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued. Organizations should also review activity from this month where logs allow to identify any potential anomalies. The incident underscores the need for robust monitoring of third-party application access.