Storm-0940 Uses AI to Breach 2,250 Microsoft Tenants via ConnectWise

More than 2,250 Microsoft 365 tenants faced attempted sign-ins from a sophisticated cyber operation this month. The activity stems from a large-scale supply chain attack targeting the ConnectWise platform. Microsoft identified the culprit as Storm-0940, a China-state-aligned actor. The group utilized ARTEX, an open-source framework for autonomous penetration testing.

The core of the operation involved unauthorized access to the multi-tenant ConnectWise application. Once inside, the attackers used stolen application credentials to authenticate without interactive user sign-ins. This allowed them to launch automated password spraying campaigns against 327 accounts across eight organizations. The campaign generated over 151,000 failed logon attempts, though none were successful in that specific vector.

The use of ARTEX accelerated the attack significantly. The framework employs large language model-driven agents to run autonomous tests. These agents handle scanning, reconnaissance, and OAuth application abuse with minimal human interaction. The speed leaves defenders little time to detect and respond. It remains unclear how the initial ConnectWise credentials were stolen or how many tenants were ultimately compromised.

Storm-0940 has been active since 2021 and has no known industry aliases. The group targeted 14 entities across aerospace, defense, semiconductor, government, and think tank sectors. Microsoft clarified that the attack did not result from a vulnerability in its own systems. Instead, it exploited the trust relationships inherent in the third-party application.

The peak of the password spraying occurred on Oct. 11. During that day, the system made 2,900 attempts per minute, totaling more than 111,000 failures. Nearly 98% of this activity resulted in account lockouts. However, the attackers also used valid ConnectWise app credentials to sign in directly. They executed more than 200 sign-ins in under four minutes using just four application credentials.

Within some tenants, the agents performed directory operations and changed privileged roles. On Oct. 15, security firm Huntress observed an app adding itself to the top administrator role in one tenant. This action triggered a specific Microsoft Defender alert. Huntress confirmed unauthorized sign-ins for 162 tenants by Oct. 16. By Oct. 17, that number rose to almost 1,000 Entra tenants with activity from the attacking IP, with over 300 sign-ins succeeding.

The sequential nature of the attacks, occurring seconds apart in sorted order, suggests a script working from a target list. The adoption of ARTEX marks a shift in traditional attack methodologies. The framework can utilize any AI model, and other actors in different regions are also using it. Recent reports linked similar technology to breaches at South Korean financial institutions. The developer of ARTEX has announced the project will become closed source and stop receiving updates.

ConnectWise has suspended several services, including Cloud Backup and SaaS Security, as a precaution. A phased restoration process has begun, with recovery expected to take several days. The company reports no indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal instructions are issued and to review recent activity logs where possible.