ConnectWise Suspends Cloud Services After AI-Driven Breach Hits 2,250 Tenants
Microsoft attributes the massive intrusion to a China-aligned group that used an open-source AI framework to automate credential theft and access control.
By Lorenzo Patterson ·
More than 2,250 Microsoft 365 tenants faced attempted sign-ins after a coordinated supply chain attack on ConnectWise. Microsoft identified the culprit as Storm-0940, a threat actor aligned with China. The group utilized ARTEX, an open-source agentic AI framework designed for autonomous penetration testing.
The attackers exploited stolen credentials belonging to specific ConnectWise applications. This allowed the AI agents to authenticate as the software itself, bypassing standard interactive user logins. The speed of the operation compressed the response window for defenders. Microsoft noted that some intrusions secured privileged access within three hours of the initial targeting.
The campaign targeted 14 specific industries, including aerospace and defense, semiconductors, and government entities. Storm-0940 has been active since 2021 and follows a naming convention for developing actors rather than established industry aliases. Microsoft clarified that the breach did not stem from a vulnerability in its own systems or products.
A parallel effort involved password spraying against 327 accounts across eight organizations. This generated over 151,000 failed logon attempts. At its peak on Oct. 11, the spray rate reached 2,900 attempts per minute. Almost 98% of these attempts resulted in account lockouts, with no successful logins recorded during this specific phase.
The more effective attack vector involved the identity takeover of ConnectWise cloud apps. Using four application credentials, the AI agents executed over 200 sign-ins in under four minutes. These sign-ins originated from a single IP range. The agents then performed directory operations, changed privileged roles, and updated group memberships within the affected tenants.
Security firm Huntress tracked the progression of the breach. On Oct. 15, they observed an app adding itself to the Global Administrator role in one tenant. This action triggered Microsoft Defender alerts. By Oct. 16, Huntress confirmed unauthorized sign-ins at 162 tenants. The following day, they identified nearly 1,000 Entra tenants with activity from the attacking IP address, with more than 300 showing successful logins.
The attackers moved through the target list in sorted order, with seconds between actions. This pattern suggested a script working from a predefined list. The use of ARTEX distinguishes this campaign from traditional methods. The framework can operate with various AI models and works continuously with minimal human input.
ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services as a precaution. The company began a phased restoration process expected to last several days. It reported no current indicators that partner backup data was compromised. Microsoft advised customers to keep affected app connections disabled until formal restoration instructions are issued.
Public reporting linked similar use of ARTEX to breaches at South Korean financial institutions. The developer of the framework, identified as Autumn-27, announced on GitHub that the project would become closed source and stop receiving updates. This shift in the tool's availability may impact future threat actors relying on the same autonomous testing capabilities.
