China-aligned hackers deploy AI agents in massive ConnectWise supply chain attack: agents attempted sign-ins at more than 2,250 Microsoft 365 tenants, with some of the group's attacks reaching privileged access in under three hours

China-state-aligned hackers used a powerful AI tool called ARTEX to carry out a massive attack on ConnectWise, a popular business management software. This attack allowed them to try to log in to over 2,250 Microsoft 365 accounts using stolen app credentials, and some of them gained high-level access within just three hours. Microsoft revealed this in its latest security report, showing how the attack was carried out with the help of AI agents that can work almost nonstop with minimal human input. The AI sped up the attack process, making it harder for defenders to respond in time. The attack was so large that it targeted many industries, including aerospace, defense, and government, with 14 total sectors hit in all.

The attack was carried out by a China-state-aligned group called Storm-0940, which has been active since 2021. They used stolen ConnectWise app credentials to try to log in to thousands of Microsoft 365 tenants, and they did this so quickly that some of them gained high-level access within less than three hours. Microsoft explained that the use of ARTEX, an open-source agentic AI penetration testing framework, made the attack much faster. The AI agents could work around the clock with little human interaction, giving the attackers a big advantage in the battle against defenders.

The attack was so large that it targeted many industries, including aerospace, defense, and government, with 14 total sectors hit in all. The attackers used password spraying, a technique where they try many different passwords at once, to target 327 accounts across eight organizations, with more than 151,000 failed logons and no successes. The use of ARTEX sped up scanning and reconnaissance, password spraying, and OAuth application abuse. The agents can work around the clock with little needed human interaction, at a pace that leaves defenders with little time to detect and respond.

It’s uncertain how the ConnectWise credentials were stolen or how many tenants were actually compromised. The attack’s sweep through tenants in sorted order, a few seconds apart, indicated that the attackers were using a script working from a target list. Microsoft noted that the activity was not caused by a flaw in its own systems, products, or services, but by the stolen app credentials that the attackers used to try to log in to thousands of tenants. The attack was so large that it targeted many industries, including aerospace, defense, and government, with 14 total sectors hit in all.

The attack was so large that it targeted many industries, including aerospace, defense, and government, with 14 total sectors hit in all. The attackers used password spraying, a technique where they try many different passwords at once, to target 327 accounts across eight organizations, with more than 151,000 failed logons and no successes. The use of ARTEX sped up scanning and reconnaissance, password spraying, and OAuth application abuse. The agents can work around the clock with little needed human interaction, at a pace that leaves defenders with little time to detect and respond.