AI Acceleration: ConnectWise Breach Exposes New Attack Vector

The intersection of artificial intelligence and enterprise security has produced a new and rapid threat vector, one that traditional defenses are struggling to contain.

Microsoft has linked a significant supply chain incident to Storm-0940, a China-aligned threat group, noting that the attackers employed an open source agentic AI framework called ARTEX. The group gained unauthorized entry to a multi tenant ConnectWise application and subsequently attempted sign ins at more than 2,250 Microsoft 365 tenants. In several cases, the intruders achieved privileged access within three hours of the initial targeting.

The operation relied on stolen credentials belonging to ConnectWise applications, allowing the attackers to authenticate as the apps themselves without interactive user sign in. The precise method of credential theft and the total number of compromised tenants remain unknown. Microsoft described ARTEX as a system of LLM driven agents that execute autonomous penetration tests. This technology accelerated scanning, password spraying, and the abuse of OAuth applications. Because these agents can operate continuously with minimal human input, defenders face compressed timelines for detection and response.

Storm 0940 has been active since 2021 and lacks industry aliases, with its name following conventions for developing actors. The campaign targeted fourteen sectors, including aerospace, defense, semiconductors, government, and think tanks. Microsoft emphasized that the breach did not originate from a vulnerability in its own systems, products, or services.

A parallel password spraying effort targeted 327 accounts across eight organizations, resulting in over 151,000 failed logons with no successes. The peak activity occurred on Oct. 11, reaching 2,900 attempts per minute. Nearly 98% of that activity resulted in lockouts, with 48 accounts logging over 1,000 failures each.

The identity takeover of ConnectWise cloud apps proved more effective. Using four application credentials, the AI agents signed in to customer tenants from the same IP range, recording over 200 sign ins in under four minutes. Within some tenants, the agents performed Graph and directory operations, conducted reconnaissance, and modified app credentials, identities, groups, and privileged roles.

Security firm Huntress observed one tenant on Oct. 15 where an app added itself to the Global Administrator role, triggering a specific Defender alert. The actions included planting new secrets set to expire in 2028. By Oct. 16, Huntress had confirmed unauthorized sign ins at 162 tenants. A day later, it counted almost 1,000 Entra tenants with sign in activity from the attacking IP, with more than 300 successful. The attackers moved through tenants in sorted order, seconds apart, suggesting a script working from a target list.

The use of a pentest framework that can work with any AI model distinguishes this campaign. Public reporting this month linked ARTEX to breaches at South Korean financial institutions, with CrowdStrike suggesting the suspect was based in China and used Anthropic's Claude Code. Reuters reported that ARTEX's developer, known as Autumn 27, stated the project would become closed source and no longer be updated.

ConnectWise detected the access and suspended Cloud Backup, SaaS Security, and Cloud Management as a precaution. A phased restoration is underway, expected to take several days, with no current indicators that partner backup data was compromised. Microsoft advised customers to keep affected app connections disabled until formal instructions are issued and to review activity logs from this month where possible.