ARTEX AI Framework Speeds ConnectWise Breach

More than 2,250 Microsoft 365 tenants recorded unauthorized sign-ins following a supply chain attack on ConnectWise. Microsoft attributed the campaign to Storm-0940, a threat actor aligned with the Chinese state. The group utilized ARTEX, an open-source framework for agentic AI penetration testing.

The attackers used stolen credentials belonging to ConnectWise applications to authenticate without interactive user sign-ins. Microsoft stated that some intrusions achieved privileged access within three hours of initial targeting. The company noted that the activity did not result from vulnerabilities in its own systems or products.

Microsoft described ARTEX as a system of large language model driven agents that run autonomous penetration tests. The framework accelerated scanning, reconnaissance, and password spraying. It also facilitated the abuse of OAuth applications. These agents operate continuously with minimal human involvement, reducing the time available for defenders to respond.

Storm-0940 has been active since 2021 and lacks known industry aliases. The group targeted 14 industries, including aerospace, defense, semiconductors, and government entities. A parallel password spraying effort targeted 327 accounts across eight organizations. That campaign produced over 151,000 failed logons with no successful entries.

The spraying peaked on October 11 with 2,900 attempts per minute. Almost 98 percent of that activity resulted in account lockouts. The takeover of ConnectWise cloud applications proved more effective. AI agents used four application credentials to sign in to customer tenants from a single IP range.

The agents recorded more than 200 sign-ins in under four minutes. They performed directory operations and changed privileged roles within some tenants. Huntress, a security firm, observed one tenant on October 15 where an app added itself to the Global Administrator role. The attackers planted new secrets set to expire in 2028.

By October 16, Huntress confirmed unauthorized sign-ins at 162 tenants. A day later, the firm counted nearly 1,000 Entra tenants with activity from the attacking IP. More than 300 of those sign-ins were successful. The attackers moved through tenants in sorted order, seconds apart, a pattern Huntress described as a script working from a target list.

ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management as a precaution. The company has begun a phased restoration expected to take several days. It reports no indicators that partner backup data was compromised. Microsoft advised customers to keep affected app connections disabled until formal restoration instructions are issued.