China-Aligned Hackers Weaponize AI Framework To Breach Microsoft Tenants

Microsoft has linked a significant supply chain attack on ConnectWise to Storm-0940, a threat group aligned with China. The operation leveraged ARTEX, an open-source framework that employs artificial intelligence agents to conduct autonomous penetration testing. This approach allowed the intruders to breach systems with a speed and autonomy that traditional manual attacks rarely achieve.

The timeline of the intrusion reveals a rapid escalation. Storm-0940 has been active since 2021 but previously lacked industry aliases. In this specific campaign, the group targeted fourteen sectors, including aerospace, defense, semiconductors, and government think tanks. Microsoft clarified that the breach did not originate from a flaw in its own services or products. Instead, the attackers exploited stolen credentials belonging to ConnectWise applications. These credentials permitted the group to authenticate as the apps themselves, bypassing standard interactive user sign-in requirements.

The mechanics of the attack relied heavily on the AI-driven capabilities of ARTEX. Microsoft described the tool as a system of large language model agents that run autonomous tests. These agents accelerated scanning, reconnaissance, and password spraying operations. Because the system could operate continuously with minimal human oversight, defenders had limited time to detect anomalies. A parallel effort involved password spraying against 327 accounts across eight organizations. This generated over 151,000 failed logons without a single success. At its peak on October 11, the spraying reached 2,900 attempts per minute, with nearly 98% of that activity resulting in lockouts.

The more effective vector involved the takeover of ConnectWise cloud apps. Using four specific application credentials, the AI agents executed more than 200 sign-ins within four minutes from a single IP range. Inside these tenants, the intruders performed directory operations, changed privileged roles, and modified group memberships. Security firm Huntress identified one tenant on October 15 where an app added itself to the Global Administrator role. This action triggered specific alerts in Microsoft Defender. The attackers also planted new secrets set to expire in 2028, a tactic designed to maintain long-term access.

By October 16, Huntress confirmed unauthorized sign-ins at 162 tenants. The following day, the count rose to nearly 1,000 Entra tenants with activity from the attacking IP address, with over 300 of those sign-ins succeeding. The movement through tenants occurred in sorted order with only seconds between actions, suggesting a script driven by a predefined target list. This efficiency distinguishes the campaign from many traditional attacks. The use of ARTEX, which can work with various AI models, has become a notable trend. Public reports this month linked the same framework to breaches at South Korean financial institutions. CrowdStrike suggested the suspect in those cases was likely based in China and used the tool with Anthropic's Claude Code.

The developer of ARTEX, known as Autumn-27, announced on GitHub that the project would no longer be updated and would transition to closed source. In response to the incident, ConnectWise suspended several of its services, including Cloud Backup and SaaS Security, as a precaution. The company has begun a phased restoration process expected to take several days. So far, it reports no indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal instructions are issued and to review activity logs from this month where possible. A successful sign-in or affected app does not automatically confirm that data was accessed or exfiltrated.