Storm-0940 Exploits AI Agents in Rapid ConnectWise Supply Chain Strike

The pace of cyber intrusion has accelerated to a speed that challenges traditional defensive rhythms.

Microsoft identified a large-scale supply chain attack on ConnectWise, executed by the China-state-aligned actor Storm-0940, which utilized ARTEX, an open-source framework of AI-driven agents. This tool allowed the group to perform autonomous penetration testing, significantly speeding up reconnaissance, password spraying, and OAuth application abuse. By leveraging stolen ConnectWise credentials, the attackers authenticated directly as applications without interactive user sign-ins, attempting access at more than 2,250 Microsoft 365 tenants. In several instances, this automated approach enabled the group to reach privileged access levels in less than three hours after initial targeting.

The operation targeted critical sectors including aerospace, defense, semiconductors, government, and think tanks, with fourteen industries listed in total. While the attack did not stem from a vulnerability in Microsoft’s own systems, the automation left defenders with minimal time to detect and respond. At its peak on October 11, the password spray campaign generated 2,900 failed attempts per minute, totaling over 111,000 for the day. Although nearly 98% of these attempts were locked out, the attackers successfully leveraged controlled ConnectWise app identities to sign into customer tenants. In one rapid burst, they executed more than 200 sign-ins in under four minutes using just four application credentials, conducting directory operations and modifying privileged roles.

Security firm Huntress observed specific malicious behaviors, such as an application assigning itself the top administrator role and planting new secrets set to expire in 2028. By October 16, Huntress confirmed unauthorized sign-ins for 162 tenants, a number that swelled to nearly 1,000 the following day, with over 300 succeeding. The systematic, seconds-apart sweep through tenants indicated the use of a script working from a predefined target list. This incident highlights a broader trend, as ARTEX has also been linked to breaches at South Korean financial institutions, where the suspect allegedly used the framework alongside Anthropic’s Claude Code.

ConnectWise has suspended several services, including Cloud Backup and SaaS Security, as a precaution while beginning a phased restoration expected to take several days. The company reports no current indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review recent activity logs. The developer of ARTEX, known as “Autumn-27,” has announced the project will no longer be updated and will become closed source, potentially altering the landscape of future AI-driven attacks.

The integration of autonomous AI agents into supply chain attacks represents a significant shift in threat methodology. As these tools become more accessible and capable of operating with little human interaction, the window for detection shrinks considerably. This incident underscores the urgent need for organizations to monitor application-based authentication flows and maintain rigorous oversight of third-party software integrations.

Uncertainties remain regarding exactly how the initial ConnectWise credentials were stolen and the precise number of tenants ultimately compromised. However, the scale and speed of the operation demonstrate that AI-assisted penetration testing is no longer a theoretical risk but an active vector for state-aligned actors seeking to exploit multi-tenant cloud environments.