AI Agents Hit 2,250 Tenants in Rapid ConnectWise Breach

The cybersecurity landscape in the South Central United States and beyond is shifting as automated tools begin to dominate supply chain attacks. A recent large-scale operation highlights how quickly automated systems can move through enterprise networks, reducing the window for human defenders to react.

The incident, detailed in a Microsoft security blog post this week, involves a China-state-aligned actor known as Storm-0940. The group utilized ARTEX, an open-source agentic AI penetration testing framework, to execute a widespread attack on the ConnectWise multi-tenant application. By leveraging stolen credentials for ConnectWise applications, the attackers authenticated as the apps themselves rather than individual users, allowing them to bypass interactive sign-in requirements.

The scale of the operation was significant, with the group attempting sign-ins across more than 2,250 Microsoft 365 tenants. The speed of the attack was a defining feature; in some instances, the actors reached privileged access levels in less than three hours after initially targeting specific tenants. This rapid progression underscores the efficiency gains provided by the AI agents, which operated autonomously with minimal human intervention.

In parallel to the application abuse, the attackers conducted automated password guessing campaigns. These efforts targeted 327 accounts across eight organizations, resulting in over 151,000 failed logon attempts without any successful breaches through this specific method. The use of ARTEX allowed the team to accelerate scanning, reconnaissance, and credential abuse, with the system capable of working around the clock at a pace that leaves defenders with limited time to detect and respond.

Storm-0940, active since 2021, has no known industry aliases and targets specific sectors including aerospace and defense, semiconductors, government entities, and think tanks. Fourteen industries were listed in total for this operation. Microsoft clarified that the attack did not stem from a vulnerability in its own systems, products, or services, but rather from unauthorized access to the ConnectWise platform.

The peak of the password spraying activity occurred on October 11, with 2,900 attempts per minute, all of which failed. That day saw more than 111,000 total attempts, with 48 specific accounts experiencing over 1,000 failures each. Nearly 98 percent of this activity resulted in lockouts. However, the use of compromised ConnectWise cloud app credentials allowed the AI agents to sign in to customer tenants from the same IP range, executing over 200 sign-ins in under four minutes using just four application credentials.

Within affected tenants, the attackers performed Graph and directory operations, conducted reconnaissance, and modified app credentials, identities, groups, and privileged roles. On October 15, security firm Huntress observed an application adding itself to the top administrator role in one tenant, a behavior that triggered a specific Microsoft Defender alert. Huntress confirmed unauthorized sign-ins for 162 tenants by October 16 and nearly 1,000 Entra tenants with activity from the attacking IP by October 17, with over 300 sign-ins succeeding.

The pattern of the attack, which swept through tenants in sorted order with intervals of a few seconds, suggested a script operating from a predefined target list. This approach differs from traditional attacks due to the reliance on an open-source pentest framework that can utilize various AI models. Recent public reporting has linked similar technology to breaches at South Korean financial institutions, with one suspect allegedly using ARTEX with Anthropic’s Claude Code. The developer of ARTEX, known as “Autumn-27,” announced that the project would stop receiving updates and transition to closed source.

ConnectWise has suspended its Cloud Backup, SaaS Security, and Cloud Management services as a precaution and has begun a phased restoration process expected to take several days. The company currently has no indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review activity logs from this month where possible, noting that a successful sign-in does not automatically confirm data access.