Microsoft Reveals How AI Agents Accelerated Massive ConnectWise Breach

More than 2,250 Microsoft 365 tenants were targeted by an aggressive wave of unauthorized sign-in attempts, according to a new security analysis from Microsoft. This figure highlights the unprecedented scale of a supply chain attack that leveraged artificial intelligence to bypass traditional defensive measures. The incident marks a significant shift in how threat actors approach enterprise security, moving from manual exploitation to automated, high-speed infiltration.

The primary driver behind this rapid escalation was the use of ARTEX, an open-source framework designed for agentic AI penetration testing. Microsoft identified the group behind the breach as Storm-0940, a China-state-aligned actor that has been active since 2021. By utilizing stolen credentials from ConnectWise, a multi-tenant application, the attackers were able to authenticate as trusted apps without requiring interactive user logins. This method allowed them to operate at a pace that left defenders with minimal time to detect and respond to the intrusion.

The speed of the attack was its most alarming feature. In several instances, the group achieved privileged access in under three hours after initially targeting a tenant. The AI agents worked around the clock with little human interaction, automating tasks such as scanning, reconnaissance, and the abuse of OAuth applications. This automation allowed the attackers to sweep through potential targets in sorted order, often just seconds apart, indicating the use of a script working from a predefined target list.

Alongside the credential-based intrusions, the group conducted extensive password spraying campaigns. These automated guessing attempts targeted 327 accounts across eight organizations, resulting in over 151,000 failed logons. At its peak on October 11, the campaign generated 2,900 attempts per minute. Although almost 98% of this activity was locked out, the sheer volume of traffic helped obscure the more successful sign-in attempts made through the compromised ConnectWise applications.

The industries affected included aerospace and defense, semiconductor manufacturing, government agencies, and think tanks, with 14 specific sectors listed in the report. Microsoft clarified that the breach did not stem from a vulnerability in its own systems or products. Instead, it resulted from unauthorized access to the third-party ConnectWise application. Once inside, the AI agents performed directory operations, changed app credentials, and modified identities and privileged roles within the compromised tenants.

Security firm Huntress provided additional insights into the attack's behavior. On October 15, they observed an application adding itself to the top administrator role, a behavior that triggered specific alerts in Microsoft Defender. The attackers also planted new secrets set to expire in 2028. By October 16, Huntress had confirmed unauthorized sign-ins for 162 tenants, a number that jumped to nearly 1,000 Entra tenants the following day, with more than 300 successful logins recorded.

The use of ARTEX is not an isolated incident. Public reporting this month linked the same framework to breaches at South Korean financial institutions. CrowdStrike noted that the suspect in those separate attacks was likely based in China and used ARTEX with Anthropic’s Claude Code. In response to the widespread use of the tool, ARTEX’s developer, known by the handle Autumn-27, announced on GitHub that the project would no longer be updated and would become closed source.

ConnectWise has suspended several of its services, including Cloud Backup, SaaS Security, and Cloud Management, as a precautionary measure. A phased restoration process has begun, with recovery expected to take several days. While there are no current indicators that partner backup data was compromised, Microsoft advises customers to keep affected app connections disabled until formal instructions are issued. The incident underscores the growing need for organizations to monitor for automated, AI-driven threats that can outpace traditional security protocols.