Microsoft blames a China-aligned hacker who used AI agents to try to break into more than 2,250 ConnectWise customers

Microsoft says a China-aligned hacking group used AI agents to attempt sign-ins to more than 2,250 customer tenants of ConnectWise, the IT software company, after stealing application credentials from its cloud backup service. The company’s threat-intelligence team names the actor Storm-0940 and says the pace of the attack, close to 3,000 attempts a minute, left defenders little time to react. Most of the targeting did not succeed, but Microsoft says the group gained privileged cloud access at many organizations.

Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.

Subscribe to TLDR →

We may earn a commission if you sign up.

The attribution belongs to Microsoft, which calls it an assessment rather than a certainty, and the company does not publish a confidence level. ConnectWise paused access to its cloud backup system while it investigated, and as of Oct. 22 it said it was working to restore the service. The details below come from Microsoft’s own write-up and from reporting on it, with each claim kept to the party that made it.

Storm-0940 and Microsoft’s attribution

In its Oct. 21 threat-intelligence post, Microsoft describes Storm-0940 as a China-state aligned actor with no known industry aliases that has been active since 2021 and targets organizations for data theft. Microsoft says it assesses that Storm-0940 was responsible for the compromise of a ConnectWise multi-tenant application. The company also says none of this resulted from a compromise of, or a vulnerability in, its own systems, products or services, which matters because the stolen credentials let the actor reach customers’ Microsoft-hosted environments.

TechCrunch, which reported the story on Oct. 22 in a piece by Zack Whittaker, summarized the stakes in plain terms: the credentials were the ones used to set up data links between ConnectWise and its corporate customers, so with them the hackers could log in as authorized users and reach emails and other files.

ARTEX and how AI agents sped up the intrusion

The AI element is a tool called ARTEX. Microsoft describes it as an open-source penetration-testing framework that can run on any AI model, built as a multi-agent system that carries out autonomous tests from reconnaissance through data exfiltration with little human involvement. Microsoft says such agents work around the clock and can try several paths into a target at once, shrinking the time from choosing a victim to reaching an objective. Storm-0940 used ARTEX to speed up scanning, reconnaissance, password spraying and the abuse of OAuth applications, and in some cases the actor reached privileged cloud access in under three hours after first targeting an organization. Microsoft documents one case in which an application assigned itself the Global Administrator role, and says the earliest Storm-0940 activity with the tool dates to early September. The tool’s interface defaults to English but can be switched to Korean, Mandarin, Spanish or Japanese.

The scale figures come from Microsoft’s telemetry. Between Oct. 10 and Oct. 14, a password-spray campaign targeted 327 accounts across eight organizations and produced more than 151,000 failed logons, peaking at about 2,900 failures a minute on Oct. 11, with nearly all attempts blocked by lockouts. Microsoft says the downstream campaign attempted sign-ins to more than 2,250 tenants through ConnectWise application credentials. Public reports of the compromise began on Oct. 15, and ConnectWise published an initial advisory the next day.

A second ARTEX campaign in South Korea

ARTEX was already in the news. CrowdStrike reported on Oct. 7 that an unnamed actor used the tool, which it describes as an open-source agentic penetration-testing tool developed in China, against South Korean financial organizations from late September to early October. CrowdStrike names no adversary and assesses with moderate confidence that the actor is a financially motivated Chinese speaker, which is a different judgment from Microsoft’s state-aligned label. Its analysis of the Korean campaign says the number of affected organizations is unconfirmed, and Microsoft says it has seen several threat actors in different regions using ARTEX.

Guidance for ConnectWise customers

Microsoft’s advice centers on caution before cleanup. Organizations should keep the affected ConnectWise application connections disabled until ConnectWise issues restoration instructions, and should avoid deleting enterprise applications as a first step so that configuration and evidence survive. Teams are told to search by application ID rather than display name, to preserve sign-in and audit logs, and to review activity from at least Oct. 15 and ideally from Oct. 1. Microsoft says that, in some environments, the follow-on activity ran through Microsoft Graph and included reconnaissance, changes to application credentials for persistence, and attempts to alter identities, groups and privileged roles. Microsoft also stresses that a compromised app or a successful sign-in does not by itself prove that data was accessed or taken.

ConnectWise has published a technical investigation and remediation guide for the cloud backup service, and Microsoft points administrators to its incident-response playbook for compromised or malicious apps. One detail worth watching is persistence: Microsoft warns that application credentials added by the actor could remain as a backdoor even after the original app is contained, so administrators are urged to verify that vendor credential rotation and their own remediation removed all unauthorized access. TechCrunch’s account is the source for the ConnectWise status described above.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

Tech news in one quick read: Subscribe to TLDR →

We may earn a commission if you sign up.