AI Agents Accelerate China-Linked Breach of ConnectWise Ecosystem

The intersection of artificial intelligence and cyber warfare has reached a new scale of speed and autonomy. Microsoft has revealed that a China-state-aligned threat actor known as Storm-0940 utilized an open-source agentic AI framework to execute a massive supply chain attack through ConnectWise. This operation marked a significant shift in how threat actors deploy automated tools to breach enterprise environments.

The attackers exploited stolen credentials from ConnectWise applications to sign in to over 2,250 Microsoft 365 tenants. Because these logins used application credentials rather than interactive user sessions, they bypassed many standard security checks. The most concerning aspect of this campaign was the speed of execution. In several instances, the group achieved privileged access within less than three hours of their initial targeting.

The core of the operation was ARTEX, a system of large language model-driven agents designed for autonomous penetration testing. This tool accelerated scanning, reconnaissance, and the abuse of OAuth applications. The agents operated around the clock with minimal human intervention, creating a tempo that left defenders with very little time to detect and respond. Automated password spraying also targeted 327 accounts across eight organizations, resulting in more than 151,000 failed logins, though none were successful.

The attack peaked on October 11, with the password spray campaign reaching 2,900 attempts per minute. While nearly 98% of these activities were locked out, the AI agents used four specific application credentials to sign in to over 200 tenants in under four minutes. Within these compromised environments, the attackers performed directory operations, changed app credentials, and modified privileged roles. The systematic nature of the sweep, moving through tenants in sorted order with seconds between actions, indicated a script working from a predefined target list.

Storm-0940, active since 2021, targeted high-value sectors including aerospace, defense, semiconductors, and government think tanks. A security firm named Huntress observed one tenant where an app added itself to the top administrator role, a behavior that triggered specific alerts. By October 17, nearly 1,000 tenants showed sign-in activity from the attacking IP range, with more than 300 successful logins. This incident highlights how open-source AI tools, which can run on various models, are being adopted by threat actors globally.

In response, ConnectWise suspended several of its cloud services as a precaution and began a phased restoration process, which is expected to take several days. The company has not found indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review recent activity logs. The developer of ARTEX has since announced that the project will no longer be updated and will become closed source, a move that may influence how future AI-driven attacks are conducted.