ConnectWise halts cloud tools after AI agents breach 2,250 tenants
Microsoft attributes the supply chain attack to Storm-0940, which used the open-source ARTEX framework to move through cloud tenants in under three hours.
By Tyler Khalil ·
ConnectWise halted its Cloud Backup, SaaS Security, and Cloud Management services this week after detecting unauthorized access to a multi-tenant application. The company paused these tools as a precaution while it investigates how stolen credentials allowed attackers to sign in as the applications themselves. Microsoft identified the threat actor as Storm-0940, a China-state-aligned group that has been active since 2021.
The attack leveraged an open-source agentic AI penetration testing framework known as ARTEX. Microsoft described the tool as a system of large language model driven agents that run autonomous penetration tests. The agents accelerated scanning, reconnaissance, password spraying, and the abuse of OAuth applications. Because the AI could operate continuously with minimal human input, defenders had limited time to detect the intrusions.
According to Microsoft, the group attempted sign-ins at more than 2,250 Microsoft 365 tenants. In some cases, the attackers achieved privileged access less than three hours after the initial targeting began. The campaign targeted 14 industries, including aerospace and defense, semiconductors, government, and think tanks. Microsoft clarified that the breach did not stem from a vulnerability in its own systems, products, or services.
A parallel password-spraying effort targeted 327 accounts across eight organizations. This activity generated more than 151,000 failed logons without any successful sign-ins. On October 11, the spray reached a peak of 2,900 attempts per minute, with over 111,000 attempts recorded that day. Approximately 98 percent of these attempts resulted in account lockouts, indicating a high volume of automated brute-force attempts.
The more effective vector was the identity takeover of ConnectWise cloud apps. Using four application credentials, the AI agents signed in to customer tenants from the same IP range. They recorded more than 200 sign-ins in under four minutes. Within these tenants, the agents performed Graph and directory operations, changed app credentials, and modified privileged roles.
Huntress, a security firm, observed specific malicious behavior on October 15. One tenant showed an app adding itself to the Global Administrator role, a trigger for a Microsoft Defender alert. The attackers planted new secrets set to expire in 2028. By October 16, Huntress confirmed unauthorized sign-ins at 162 tenants. A day later, the count rose to almost 1,000 Entra tenants with sign-in activity from the attacking IP, with more than 300 of those sign-ins successful. The attackers moved through tenants in sorted order, seconds apart, a pattern Huntress described as a script working from a target list.
The use of ARTEX distinguishes this campaign from traditional attacks. The framework can work with any AI model, and public reporting this month linked it to breaches at South Korean financial institutions. CrowdStrike stated that the suspect in those separate attacks was likely based in China and allegedly used ARTEX with Anthropic’s Claude Code. Reuters reported that the developer of ARTEX, who uses the handle Autumn-27, announced on GitHub that the project would become closed source and would no longer be updated.
ConnectWise has begun a phased restoration of its suspended services, a process expected to take several days. The company stated it has no indicators so far that partner backup data was compromised. Microsoft advised customers to keep affected app connections disabled until formal restoration instructions are issued. It also recommended that organizations review activity from this month where logs permit, noting that an affected app or successful sign-in does not necessarily mean data was accessed or taken.
