Storm-0940 Exploits AI Agents in ConnectWise Credential Abuse

A hacking group aligned with the Chinese state used an open-source AI penetration testing framework to automate a massive supply chain attack against ConnectWise, according to Microsoft. The group, identified as Storm-0940, deployed autonomous agents to attempt sign-ins across more than 2,250 Microsoft 365 tenants using credentials stolen from the multi-tenant application. In certain instances reported by Microsoft, the attackers achieved privileged access in under three hours from the initial targeting.

The attackers utilized ARTEX, described by Microsoft as a system of LLM-driven agents capable of running autonomous penetration tests. This technology allowed the agents to perform scanning, reconnaissance, and password spraying with little human interaction. Microsoft stated that such automation operates around the clock and leaves defenders with little time to detect and respond. While the specific method of credential theft remains uncertain, the group attempted automated password guessing targeting 327 accounts across eight organizations, resulting in more than 151,000 failed logons without any successes. At its peak on October 11, the activity generated nearly 2,900 failed attempts per minute.

By controlling the identities of multiple ConnectWise cloud apps, the AI agents signed in to customer tenants from a single IP range using those application credentials. Security firm Huntress reported that on October 15, an application added itself to the top administrator role within one tenant. Huntress confirmed unauthorized sign-ins for 162 tenants by October 16, a figure that grew to almost 1,000 Entra tenants the following day with over 300 successful sign-ins. The sequence of attacks through tenants in sorted order, occurring seconds apart, indicated a script working from a target list.

ConnectWise has suspended Cloud Backup, formerly SkyKick, SaaS Security, and Cloud Management as a precautionary measure. A phased restoration process is underway and is expected to take several days. The company stated it has no indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until restoration instructions are issued and to review activity from this month where logs allow.

CrowdStrike noted that suspect actors in separate attacks against South Korean financial institutions likely used ARTEX with Anthropic’s Claude Code. The developer of ARTEX, who uses the handle Autumn-27, announced on GitHub that the project will no longer be updated and will become closed source.