Microsoft has attributed a large supply chain attack involving ConnectWise to Storm-0940, a China-state-aligned threat actor, which it says relied on an open-source agentic AI penetration testing framework called ARTEX. According to the company's Security blog, the group gained unauthorized access to a multi-tenant ConnectWise application and then attempted sign-ins at more than 2,250 Microsoft 365 tenants. Some of its intrusions reached privileged access less than three hours after the initial targeting.
The attackers used stolen credentials belonging to ConnectWise apps, which allowed them to authenticate as the apps themselves without any interactive user sign-in. It remains unclear how those credentials were obtained and how many tenants were ultimately compromised. Microsoft described ARTEX as "a system of LLM-driven agents that run an autonomous penetration test," and said it sped up scanning and reconnaissance, password spraying, and abuse of OAuth applications. Such agents can operate around the clock with little human involvement, leaving defenders little time to detect and respond.
Storm-0940 has been active since 2021 and has no known industry aliases, with its designation following the convention for a developing actor. Targeted sectors in this campaign included aerospace and defense, semiconductors, government and think tanks, among 14 industries listed in total. Microsoft stressed that the activity did not stem from a compromise of, or a vulnerability in, its own systems, products or services.
A parallel password-spraying effort went after 327 accounts across eight organizations, producing more than 151,000 failed logons and no successes. At its peak on Oct. 11, the spray reached 2,900 attempts per minute, all unsuccessful, and more than 111,000 for the day, with 48 accounts each logging over 1,000 failures. Almost 98% of that activity was locked out.
The identity takeover of several ConnectWise cloud apps proved more effective. Using four application credentials, the AI agents signed in to customer tenants from the same IP range, recording more than 200 sign-ins in under four minutes. Within some tenants, they carried out Graph and directory operations and reconnaissance, and changed app credentials, identities, groups and privileged roles.
Security firm Huntress observed one tenant on Oct. 15 in which an app added itself to the Global Administrator role, the behavior behind the Microsoft Defender alert "Application self-assigned Global Administrator role." The actions included planting new secrets set to expire in 2028. By Oct. 16, Huntress had confirmed unauthorized sign-ins at 162 tenants. A day later it counted almost 1,000 Entra tenants with sign-in activity from the attacking IP, more than 300 of them successful. The attackers moved through tenants in sorted order, seconds apart, suggesting "a script working from a target list."
The use of a pentest framework that Microsoft says can work with any AI model sets the campaign apart from many traditional attacks. Threat actors in several regions use the tool, and public reporting this month linked it to breaches at South Korean financial institutions. CrowdStrike said the suspect in those separate attacks was likely based in China and allegedly used ARTEX with Anthropic's Claude Code. Reuters reported that ARTEX's developer, who goes by "Autumn-27," said on GitHub that the project "will no longer be updated" and would become closed source.
ConnectWise detected the unauthorized access and, as a precaution, suspended Cloud Backup (formerly SkyKick) along with SaaS Security and Cloud Management. It has begun a phased restoration expected to take several days and says it has no indicators so far that partner backup data was compromised.
Microsoft cautioned that an affected app, or even a successful sign-in, does not necessarily mean data was accessed or taken. It advised customers to keep affected app connections disabled until formal restoration instructions are issued, and to review activity from this month where logs permit.
