China group uses AI to hit 2,250 tenants
Storm-0940 exploited stolen ConnectWise keys to breach Microsoft 365 accounts, with some privileged access gained in under three hours.
By Natalia Costa ·
Microsoft attributes a large-scale supply chain attack to Storm-0940, a China-state-aligned threat group. The attackers used an open-source AI framework called ARTEX to infiltrate a multi-tenant ConnectWise application. They then attempted sign-ins to more than 2,250 Microsoft 365 tenants. Some intrusions reached privileged access levels in less than three hours.
The group used stolen credentials for ConnectWise apps. This allowed them to authenticate as the applications without requiring interactive user sign-ins. Microsoft described ARTEX as a system of LLM-driven agents that run autonomous penetration tests. The AI agents accelerated scanning, reconnaissance, and password spraying. They also abused OAuth applications. These agents can operate continuously with minimal human input, reducing the time defenders have to respond.
Storm-0940 has been active since 2021. The group targeted 14 industries, including aerospace, defense, semiconductors, and government entities. Microsoft stated that the attack did not originate from a vulnerability in its own systems or products. A separate password-spraying campaign hit 327 accounts across eight organizations. This effort generated more than 151,000 failed logons with no successes. At its peak on Oct. 11, the spray reached 2,900 attempts per minute. Nearly 98% of that activity resulted in account lockouts.
The takeover of ConnectWise cloud apps proved more effective. Using four application credentials, the AI agents signed into customer tenants from the same IP range. They recorded more than 200 sign-ins in under four minutes. Inside some tenants, the agents performed directory operations and changed app credentials and privileged roles. They moved through tenants in sorted order, seconds apart, indicating a script working from a target list.
Security firm Huntress confirmed unauthorized sign-ins at 162 tenants by Oct. 16. By Oct. 17, the count rose to almost 1,000 Entra tenants with activity from the attacking IP. More than 300 of those sign-ins were successful. On Oct. 15, Huntress observed an app adding itself to the Global Administrator role in one tenant. The attackers also planted new secrets set to expire in 2028.
ConnectWise detected the unauthorized access and suspended Cloud Backup, SaaS Security, and Cloud Management services. The company has begun a phased restoration expected to take several days. It reports no indicators that partner backup data was compromised. Microsoft advised customers to keep affected app connections disabled until formal restoration instructions are issued.
Public reporting this month linked the ARTEX framework to breaches at South Korean financial institutions. CrowdStrike said the suspect in those attacks likely used ARTEX with Anthropic's Claude Code. Reuters reported that the developer of ARTEX, known as Autumn-27, stated on GitHub that the project would no longer be updated and would become closed source.
