Microsoft Blames Chinese Group for AI-Driven ConnectWise Breach

Microsoft identified Storm-0940 as the group behind a massive supply chain attack that compromised access to more than 2,250 Microsoft 365 tenants. The company stated that the threat actor, which is aligned with the Chinese state, leveraged an open-source artificial intelligence framework known as ARTEX to execute the intrusion. The attack targeted a multi-tenant ConnectWise application, allowing the attackers to bypass standard user authentication methods.

The intruders utilized stolen credentials belonging to ConnectWise applications to sign in as the apps themselves. This method eliminated the need for interactive user logins. Microsoft described ARTEX as a system of large language model driven agents that conduct autonomous penetration tests. The tool accelerated the scanning, reconnaissance, and password spraying phases of the attack. According to the company, some intrusions reached privileged access levels less than three hours after initial targeting began.

Storm-0940 has been active since 2021 and currently has no known industry aliases. The group targeted 14 industries, including aerospace, defense, semiconductors, and government think tanks. Microsoft emphasized that the attack did not originate from a vulnerability in its own products or services. The firm noted that the use of an autonomous AI framework distinguishes this campaign from many traditional cyber operations.

A separate password spraying campaign hit 327 accounts across eight organizations. This effort generated over 151,000 failed logon attempts. On October 11, the attack peaked at 2,900 attempts per minute. Despite the volume, 98% of the accounts were locked out, and no logons succeeded during this specific phase of the operation.

Huntress, a security firm, observed the attack in action on October 15. At one tenant, an application added itself to the Global Administrator role. The attackers planted new secrets set to expire in 2028. By October 16, Huntress confirmed unauthorized sign-ins at 162 tenants. The following day, the count rose to nearly 1,000 Entra tenants with activity from the attacking IP address. More than 300 of these sign-ins were successful. The attackers moved through the tenants in sorted order, with actions occurring seconds apart.

Public reporting this month linked the ARTEX framework to breaches at South Korean financial institutions. CrowdStrike suggested the suspect in those separate attacks was likely based in China. Reuters reported that the developer of ARTEX, who uses the handle Autumn-27, announced on GitHub that the project would become closed source and would no longer receive updates. The framework can operate with various AI models, increasing its utility for different threat actors.

ConnectWise detected the unauthorized access and suspended its Cloud Backup, SaaS Security, and Cloud Management services as a precaution. The company has started a phased restoration process that it expects to complete in several days. ConnectWise stated it has no indicators that partner backup data was compromised. Microsoft advised customers to keep affected app connections disabled until formal restoration instructions are issued and to review recent activity logs where possible.