Microsoft Details Deployment of AI Agents by China-Linked Group in ConnectWise Breach

Microsoft has disclosed that a threat actor aligned with the Chinese state utilized an artificial intelligence framework to orchestrate a significant supply chain intrusion via ConnectWise. The group, identified as Storm-0940, employed ARTEX, an open-source agentic AI penetration testing system, to accelerate various stages of the attack. This deployment represents a notable shift in cyber operations, where autonomous digital agents handle reconnaissance and exploitation with minimal human oversight, fundamentally altering the speed at which defenders must respond.

The scale of the operation was extensive, with the attackers attempting sign-ins at more than 2,250 Microsoft 365 tenants. By leveraging stolen ConnectWise application credentials, the group authenticated as the applications themselves, bypassing the need for interactive user login. The efficiency of this AI-driven approach was stark; in several instances, the attackers achieved privileged access within less than three hours of initially targeting a specific organization. This rapid timeline compressed the window for detection and mitigation, placing immense pressure on security teams to identify anomalies before significant damage occurred.

Alongside the application-based intrusions, the group conducted aggressive automated password guessing campaigns, a technique known as password spraying. These attempts targeted 327 accounts across eight distinct organizations, resulting in more than 151,000 failed logons without a single success. At its peak on October 11, the operation generated 2,900 attempts per minute, totaling over 111,000 failures for the day. While nearly 98 percent of this activity resulted in account lockouts, the sheer volume of attempts demonstrated the capability of the AI agents to operate continuously with limited human intervention.

Storm-0940, active since 2021, is characterized by Microsoft as a developing actor with no known industry aliases. The group targeted a specific set of 14 industries, including aerospace and defense, semiconductor manufacturing, government agencies, and think tanks. Microsoft clarified that the attack did not stem from a vulnerability in its own systems or products, but rather from unauthorized access to the multi-tenant ConnectWise application. The use of ARTEX, described as a system of large language model-driven agents, allowed for autonomous execution of scanning, reconnaissance, and OAuth application abuse.

The operational details reveal a highly coordinated effort. Using four specific application credentials, the agents performed more than 200 sign-ins in under four minutes, all originating from the same IP range. Within the compromised tenants, the attackers performed directory operations, reconnaissance, and modifications to app credentials, identities, and privileged roles. On October 15, security firm Huntress observed an application adding itself to a top administrator role, a behavior that triggered alerts in Microsoft Defender. This action included planting new secrets set to expire in 2028, a tactic designed to maintain long-term access.

By October 16, Huntress had confirmed unauthorized sign-ins for 162 tenants. The following day, the number of Entra tenants showing sign-in activity from the attacking IP rose to nearly 1,000, with more than 300 of those sign-ins succeeding. The pattern of the attack, which swept through tenants in sorted order with intervals of only a few seconds, indicated that a script was working from a predefined target list. This methodical approach highlights the precision and automation afforded by the AI framework, allowing for a systematic traversal of potential victims.

The use of ARTEX distinguishes this incident from many traditional attacks due to its reliance on an open-source pentest framework that can utilize various AI models. Public reports this month have linked the technology to breaches at South Korean financial institutions, where the suspect was likely based in China and allegedly used ARTEX with Anthropic’s Claude Code. In response to the growing threat landscape, the developer of ARTEX, known by the handle Autumn-27, announced on GitHub that the project would become closed source and would no longer receive updates, a move reported by Reuters.

ConnectWise has acknowledged the unauthorized access and has taken precautionary steps by suspending its Cloud Backup, formerly known as SkyKick, as well as its SaaS Security and Cloud Management services. A phased restoration process has begun, with recovery expected to take several days. To date, ConnectWise has not indicated that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review activity logs from this month where possible, noting that a successful sign-in does not automatically confirm data access.

The incident underscores the evolving nature of supply chain attacks, where the integration of AI agents reduces the time between initial access and full compromise. For organizations in the Pacific Northwest and beyond, the stakes are high, as the rapid pace of these attacks leaves little room for error. The transition of ARTEX to closed source may impact future threat actors, but the immediate lesson remains the need for robust monitoring and rapid response capabilities in the face of automated, AI-driven intrusions.