Open Source AI Framework Drives Rapid 2,250 Tenant Breach

ConnectWise has paused its Cloud Backup, SaaS Security, and Cloud Management services to secure its platform. The company detected unauthorized access to its multi-tenant application and halted operations to prevent further spread. It has begun a phased restoration process expected to last several days. ConnectWise stated it has no current indicators that partner backup data was compromised.

Microsoft attributed the attack to Storm-0940, a China-state-aligned threat actor. The group used stolen credentials belonging to ConnectWise applications. These credentials allowed the attackers to authenticate as the apps themselves without requiring interactive user sign-ins. Microsoft reported that the intruders attempted sign-ins at more than 2,250 Microsoft 365 tenants. Some intrusions reached privileged access levels less than three hours after the initial targeting began.

Microsoft identified the tool used in the campaign as ARTEX, an open-source agentic AI penetration testing framework. The company described ARTEX as a system of LLM-driven agents that run autonomous penetration tests. Microsoft stated that the framework accelerated scanning, reconnaissance, password spraying, and the abuse of OAuth applications. The agents operated around the clock with minimal human involvement. This speed left defenders with limited time to detect and respond to the intrusion.

The campaign targeted 14 industries, including aerospace and defense, semiconductors, government, and think tanks. A separate password-spraying effort targeted 327 accounts across eight organizations. This activity produced more than 151,000 failed logons and no successes. At its peak on Oct. 11, the spray reached 2,900 attempts per minute. More than 111,000 failures were recorded that day, with 48 accounts each logging over 1,000 failures. Almost 98% of that activity resulted in account lockouts.

Security firm Huntress observed specific malicious behaviors in affected tenants. On Oct. 15, an app in one tenant added itself to the Global Administrator role. This action triggered a Microsoft Defender alert. The attackers also planted new secrets set to expire in 2028. By Oct. 16, Huntress confirmed unauthorized sign-ins at 162 tenants. A day later, the firm counted nearly 1,000 Entra tenants with sign-in activity from the attacking IP. More than 300 of those sign-ins were successful. The attackers moved through tenants in sorted order, seconds apart, which suggested a script working from a target list.

Microsoft emphasized that the activity did not stem from a compromise or vulnerability in its own systems, products, or services. The company advised customers to keep affected app connections disabled until formal restoration instructions are issued. It also recommended that customers review activity from this month where logs permit. Microsoft noted that an affected app or successful sign-in does not necessarily mean data was accessed or taken.

Reuters reported that ARTEX's developer, known as Autumn-27, announced on GitHub that the project will no longer be updated and will become closed source. Public reporting this month linked the framework to breaches at South Korean financial institutions. CrowdStrike said the suspect in those separate attacks was likely based in China and allegedly used ARTEX with Anthropic's Claude Code. Threat actors in several regions use the tool, which can work with any AI model.