AI bots scanned over 2,250 business accounts in a rapid cyber heist

More than 2,250 Microsoft 365 tenants faced attempted sign-ins from a coordinated cyberattack that leveraged artificial intelligence to bypass traditional security checks. Microsoft disclosed on its security blog that the operation targeted ConnectWise, a widely used IT management platform, to gain unauthorized access to customer environments. The attackers used stolen application credentials to authenticate as the software itself, allowing them to enter systems without an interactive user sign-in. In several cases, the group reached privileged access levels within three hours of first targeting a specific organization.

The campaign, attributed to a threat actor known as Storm-0940, began with the exploitation of a multi-tenant application. The group utilized ARTEX, an open-source framework designed for autonomous penetration testing. This system employs large language model agents to conduct scanning, reconnaissance, and credential abuse with minimal human oversight. The automation allowed the attackers to operate continuously at a pace that left defenders with very little time to detect and respond to the intrusion. It remains unclear exactly how many tenants were fully compromised or how the initial ConnectWise credentials were stolen.

Storm-0940 has been active since 2021 and is described as a China-state aligned actor with no known industry aliases. The group targeted 14 industries, including aerospace and defense, semiconductor manufacturing, government agencies, and think tanks. Microsoft clarified that the attack did not stem from a vulnerability in its own systems or products. Instead, the breach originated from the ConnectWise platform, which serves as a bridge for many IT operations.

The automated password spraying component of the attack was particularly aggressive. On its peak day, October 11, the system generated nearly 111,000 failed logon attempts across 327 accounts in eight organizations. At its fastest, the bots made 2,900 attempts per minute. Despite the volume, almost 98% of these attempts were locked out, indicating the method was largely unsuccessful on its own. However, the attackers also exploited four specific application credentials to sign in as trusted apps, achieving more than 200 successful logins in under four minutes.

Security firm Huntress observed the attack in real time on October 15. They noted an application adding itself to the top administrator role, a behavior that triggered specific Microsoft Defender alerts. The group also planted new secrets configured to expire in 2028. By October 16, Huntress had confirmed unauthorized sign-ins at 162 tenants. The following day, nearly 1,000 tenants showed sign-in activity from the attacking IP range, with more than 300 of those attempts succeeding. The sequential nature of the attacks suggested a script working through a sorted target list.

This incident marks a shift in how threat actors deploy AI. ARTEX can utilize various AI models, and other groups are reportedly using similar tools. Public reports this month linked the framework to breaches at South Korean financial institutions, with suspects allegedly using it in conjunction with other AI coding tools. The developer of ARTEX has stated that the project will become closed source and will no longer receive updates, a move that may influence how attackers adapt their toolkits in the future.

ConnectWise has suspended several of its cloud services, including Cloud Backup and SaaS Security, as a precautionary measure. The company has begun a phased restoration process, with full recovery expected to take several days. There are currently no indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review activity logs from this month where available. The incident highlights the growing speed and scale of AI-driven supply chain attacks in the corporate sector.