AI-Driven Intrusion: Hackers Exploit Framework to Flood Thousands of Corporate Accounts

A sophisticated cyberattack has targeted thousands of business networks using artificial intelligence agents to move with unprecedented speed. Microsoft revealed that a group known as Storm-0940 utilized ARTEX, an open-source framework designed for automated penetration testing, to launch a supply chain attack against ConnectWise. This incident highlights how AI can accelerate the intrusion process, allowing attackers to reach high-level privileges in some cases within just three hours of initial contact.

The attackers gained unauthorized access to the multi-tenant ConnectWise application and used stolen credentials to sign in to more than 2,250 Microsoft 365 tenants. These sign-ins were authenticated directly through the application, bypassing the need for interactive user logins. In parallel, the group conducted extensive password spraying campaigns. These automated guesses targeted 327 accounts across eight organizations, resulting in over 151,000 failed login attempts, though none were successful. The ARTEX framework sped up these scanning and reconnaissance efforts, with the AI agents operating around the clock with minimal human intervention.

Storm-0940 has been active since 2021 and is described by Microsoft as a China-state aligned actor without known industry aliases. The recent campaign focused on several key sectors, including aerospace and defense, semiconductors, government agencies, and think tanks. Microsoft clarified that the attack did not stem from a vulnerability in its own systems or products. Instead, the breach originated from the compromise of the third-party ConnectWise service. It remains unclear exactly how the initial ConnectWise credentials were stolen or the total number of tenants actually compromised.

The scale of the automated attacks was substantial. On October 11, the password spraying activity peaked at 2,900 attempts per minute, totaling more than 111,000 failures for that day. Nearly 98% of these attempts resulted in account lockouts. However, the use of ConnectWise app credentials allowed the agents to bypass these locks. From the same IP range, the attackers executed over 200 sign-ins in under four minutes using just four application credentials. Within the affected tenants, the agents performed directory operations, changed app credentials, and modified privileged roles.

Security firm Huntress observed specific behaviors on October 15, such as an application adding itself to the top administrator role. This action triggered a Microsoft Defender alert regarding self-assigned Global Administrator roles. The attackers also planted new secrets set to expire in 2028. By October 16, Huntress had confirmed unauthorized sign-ins for 162 tenants. A day later, almost 1,000 Entra tenants showed sign-in activity from the attacking IP, with more than 300 succeeding. The sequential nature of the sweep, with actions occurring seconds apart, suggested a script working from a predefined target list.

This incident differs from traditional attacks due to the reliance on ARTEX, which can utilize various AI models. CrowdStrike noted that similar attacks on South Korean financial institutions likely used the same framework, possibly with Anthropic’s Claude Code. The developer of ARTEX, known as Autumn-27, announced on GitHub that the project would become closed source and cease updates. ConnectWise has suspended several of its cloud services as a precaution and has begun a phased restoration process, which is expected to take several days. The company currently has no indicators that partner backup data was compromised.

Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued. Companies should also review activity logs from this month where possible. The incident serves as a reminder that an affected app or successful sign-in does not automatically mean data was accessed or taken. Defense teams must remain vigilant against AI-assisted threats that can operate at a pace leaving little time for detection and response.