Microsoft Details Storm-0940 Use of AI Agents in ConnectWise Breach
Microsoft has released a report detailing how a China-aligned hacking group used automated agents to attempt access to thousands of Microsoft 365 tenants following an intrusion at ConnectWise.
By Carmen Wojcik ·
For businesses and organizations using Microsoft 365, the security of their cloud accounts is a direct concern. Microsoft's recent report details a significant security incident where a state-aligned hacking group attempted to gain access to over 2,250 Microsoft 365 tenants. The activity stemmed from a breach at ConnectWise, a company providing IT management software. This means that any organization using ConnectWise services could be at risk, and Microsoft is advising customers to review their application connections and activity logs from this month to ensure their accounts remain secure.
The core of the issue lies in an attack on ConnectWise's systems. Following this unauthorized access, the attackers attempted to sign in to more than 2,250 Microsoft 365 tenants using stolen application credentials from ConnectWise. This method allowed the attackers to authenticate as the application itself, without needing an individual user's login. Microsoft's report indicates that in some cases, these attacks achieved privileged access within a remarkably short timeframe, less than three hours after the initial targeting began. This rapid progression highlights the speed and efficiency of the operation.
Microsoft attributes this attack to a group it has named Storm-0940, which it identifies as a China-state-aligned actor active since 2021. The group's activity targeted a variety of sectors, including aerospace and defense, semiconductors, government, and think tanks, among a total of 14 listed industries. Microsoft's analysis also makes clear that this activity did not result from a compromise of or a vulnerability in Microsoft's own systems, products, or services, pointing instead to the breach at ConnectWise as the origin.
A significant factor in the attack's speed and scale is the use of an open-source tool named ARTEX. Described as a system of LLM-driven agents that run an autonomous penetration test, ARTEX automates tasks like scanning, reconnaissance, and password spraying. Microsoft states these agents can operate around the clock with little human interaction, at a pace that leaves defenders with little time to detect and respond. The group also engaged in automated password guessing, targeting 327 accounts across eight organizations with more than 151,000 failed logons and no successes.
The scale of the automated attempts was substantial. On October 11, the password spray activity peaked at 2,900 attempts per minute, all of which failed, and reached more than 111,000 for that day. While almost 98% of this activity was locked out, the attackers used stolen application credentials to sign in to customer tenants from a shared IP address. More than 200 sign-ins occurred in under four minutes using four application credentials, and operations within some tenants included reconnaissance, changes to identities and groups, and modifications to privileged roles.
Further investigation by security firm Huntress revealed that in one tenant on October 15, an application added itself to the top administrator role. By October 16, Huntress confirmed unauthorized sign-ins for 162 tenants, and a day later, almost 1,000 Entra tenants showed sign-in activity from the attacking IP address, with more than 300 succeeding. The sequential nature of the attempts, moving through tenants in sorted order a few seconds apart, indicated what Microsoft described as "a script working from a target list."
ConnectWise has acknowledged the unauthorized access and suspended Cloud Backup (formerly SkyKick), SaaS Security, and Cloud Management as a precaution. A phased restoration has begun and is expected to take several days, though the company stated it has no indicators to date that partner backup data was compromised. Microsoft advises that an affected app or a successful sign-in does not necessarily mean data was accessed or taken, and it recommends customers keep affected app connections disabled until formal restoration instructions are issued. The source material also notes that it is uncertain how the ConnectWise credentials were stolen or how many tenants were actually compromised.
