Hackers Use AI Agents in Major Attack

More than 2,250 Microsoft 365 tenants saw automated sign-in attempts as part of a massive campaign, with attackers reaching privileged access in under three hours during some intrusions.

The campaign involved a China-state-aligned actor designated Storm-0940. This group, active since 2021, is described as a China-state aligned actor with no known industry aliases, and its name follows the convention for a developing actor. The operation centered on a supply chain compromise at ConnectWise. Microsoft reported the activity in its Security blog.

The attack utilized stolen ConnectWise application credentials to authenticate as those apps without requiring an interactive user sign-in. Storm-0940 also executed automated password guessing, or password spraying, targeting 327 accounts across eight organizations. This effort generated more than 151,000 failed logons with no successes. At its peak on Oct. 11, the password spray engaged in 2,900 attempts, all failures, per minute, at more than 111,000 for that day, with 48 accounts logging more than 1,000 failures each. Almost 98% of this activity was locked out.

Central to the campaign was the use of ARTEX, an open-source agentic AI penetration testing framework. Microsoft described ARTEX as a system of LLM-driven agents that run an autonomous pentest. The use of ARTEX sped up scanning and reconnaissance, password spraying, and OAuth application abuse. The agents can work around the clock with little needed human interaction, at a pace that leaves defenders with little time to detect and respond. It is uncertain how the ConnectWise credentials were stolen or how many tenants were actually compromised.

With control of the identities of multiple ConnectWise cloud apps, the attacking AI agents signed in to customer tenants from the same IP range using those apps' credentials, with more than 200 sign-ins in under four minutes using four application credentials. Operations taken within some tenants include Graph and directory operations, reconnaissance, app credential changes, plus changes to identities, groups, and privileged roles. In one tenant on Oct. 15, Huntress, a security firm, saw an app add itself to the top administrator role, the behavior behind the Microsoft Defender alert Application self-assigned Global Administrator role. Actions included planting new secrets set to expire in 2028. It confirmed unauthorized sign-ins for 162 tenants by Oct. 16 and, a day later, almost 1,000 Entra tenants with sign-in activity from the attacking IP, with more than 300 succeeding. The attack's sweep through tenants in sorted order, a few seconds apart, indicated a script working from a target list.

Microsoft noted the activity did not result from a compromise of or a vulnerability in Microsoft's systems, products, or services. The targets included industries such as aerospace and defense, semiconductor, government, and think tanks, with 14 listed in total. The agency noted that an affected app, or even a successful sign-in, does not necessarily mean data was accessed or taken.

What differs from many traditional attacks is the use of the open-source pentest framework that, Microsoft says, can use any AI model. Threat actors in multiple regions are using the technology, and public reporting this month tied it to breaches at South Korean financial institutions. CrowdStrike said the suspect in those separate attacks was likely based in China and allegedly used ARTEX with Anthropic's Claude Code. ARTEX's developer, who goes by the handle Autumn-27, said on GitHub that the ARTEX project will no longer be updated and would become closed source, Reuters reported.

ConnectWise noted the unauthorized access and suspended Cloud Backup (formerly SkyKick) as well as SaaS Security and Cloud Management as a precaution. It has started a phased restoration with recovery expected to take several days and has no indicators to date that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued, and to review activity from this month where logs allow.

It remains uncertain how the ConnectWise credentials were stolen or how many tenants were actually compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued, and to review activity from this month where logs allow.