Attackers Deploy AI Agents to Breach ConnectWise Supply Chain

A China-aligned threat group has leveraged artificial intelligence to launch an automated assault on the ConnectWise supply chain, attempting to access thousands of Microsoft 365 accounts.

Microsoft's Security blog details how the actor, Storm-0940, utilized ARTEX, an open-source framework designed for autonomous penetration testing driven by large language models. Following unauthorized entry into a multi-tenant application, the group attempted sign-ins across more than 2,250 tenants using stolen credentials. The AI agents were able to operate continuously with minimal human oversight, significantly accelerating scanning, reconnaissance, and password spraying. In some cases, attackers achieved privileged access in less than three hours from initial targeting. The specific method used to obtain the ConnectWise credentials and the exact number of compromised tenants remains under investigation.

Storm-0940 has been active since 2021 and is identified as a China-state aligned actor. The operation targeted various sectors, including aerospace, defense, semiconductors, government, and think tanks, among a total of 14 industries. Microsoft confirmed the activity did not stem from a vulnerability within its own systems or products. Automated password guessing also targeted 327 accounts across eight organizations, generating over 151,000 failed logons without any successful access. The attempt peaked on October 11 with 2,900 attempts per minute, though nearly 98% of this activity resulted in account lockouts.

Despite the failed password attempts, the attackers successfully signed into customer tenants using compromised application credentials. On October 15, security firm Huntress observed an application attempting to self-assign itself to the top administrator role, triggering a Microsoft Defender alert. By October 16, Huntress confirmed unauthorized sign-ins for 162 tenants. A day later, it identified almost 1,000 Entra tenants with sign-in activity from the attacking IP range, with more than 300 succeeding. The sequential targeting of tenants indicated a script operating from a list.

The use of an open-source pentest framework capable of utilizing any AI model distinguishes this campaign from traditional attacks. Public reporting this month linked similar technology to breaches involving South Korean financial institutions. CrowdStrike attributed those attacks to a suspect likely based in China who allegedly used ARTEX with Anthropic's Claude Code. The developer of ARTEX, operating under the handle Autumn-27, announced on GitHub that the project would no longer be updated and would become closed source.

ConnectWise acknowledged the unauthorized access and suspended Cloud Backup (formerly SkyKick), SaaS Security, and Cloud Management as a precaution. The company has initiated a phased restoration process expected to take several days, noting it has no indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review activity from this month where logs allow.