China-linked hackers use AI to breach 2,250 Microsoft 365 accounts via ConnectWise
Automated agents accelerated a supply chain attack that reached privileged system roles in under three hours.
By Madison Lewis ·
Businesses relying on the ConnectWise platform face new security risks after a large-scale attack exposed their systems to automated threats. The incident forced many organizations to temporarily suspend key services while they worked to restore normal operations. For IT managers, the speed of the intrusion highlights a shifting landscape where defenders have less time to react.
Microsoft identified the attacker as Storm-0940, a group aligned with the Chinese state. The actor used ARTEX, an open-source framework driven by large language models, to conduct the operation. This tool allowed the hackers to run autonomous penetration tests with minimal human input. The system scanned for weaknesses and attempted logins at a pace that traditional manual attacks could not match.
The attack targeted more than 2,250 distinct Microsoft 365 tenants. The hackers used stolen credentials from ConnectWise applications to authenticate without interactive user sign-ins. In some cases, the group achieved privileged access within three hours of initial targeting. This rapid progression allowed them to modify identities, groups, and roles within the affected organizations.
A significant portion of the effort involved automated password spraying. The attackers targeted 327 accounts across eight organizations, resulting in over 151,000 failed login attempts. Notably, none of these password guesses succeeded. At its peak on October 11, the system made 2,900 attempts per minute. Almost 98% of these activities were locked out, indicating a brute-force strategy that relied on volume rather than precision.
Despite the high failure rate of password guessing, the compromise of application credentials proved decisive. The AI agents used four specific application credentials to sign in to customer tenants. They executed more than 200 sign-ins in under four minutes from the same IP range. The sequential nature of these logins, occurring seconds apart, suggested a script working from a pre-defined target list.
Security firm Huntress observed specific malicious behaviors in one tenant on October 15. An application added itself to the top administrator role, triggering alerts in Microsoft Defender. The attackers also planted new secrets configured to expire in 2028. By October 16, Huntress confirmed unauthorized sign-ins for 162 tenants. By the next day, nearly 1,000 Entra tenants showed sign-in activity from the attacking IP address, with more than 300 succeeding.
The industries targeted included aerospace and defense, semiconductors, government, and think tanks. Fourteen sectors were listed in total. Microsoft clarified that the attack did not stem from a vulnerability in its own systems or products. Instead, it resulted from unauthorized access to the multi-tenant ConnectWise application. The use of ARTEX sped up reconnaissance and OAuth application abuse significantly.
ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services as a precaution. It has begun a phased restoration process, with full recovery expected to take several days. The company reported no indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued. It also recommends reviewing activity logs from this month where possible.
The developer of ARTEX has stated the project will no longer be updated and will become closed source. This move follows public reports linking the framework to breaches at South Korean financial institutions. CrowdStrike indicated the suspect in those separate attacks was likely based in China. The adoption of this tool by threat actors in multiple regions signals a broader shift toward automated, AI-driven cyber operations.
