Microsoft says China-aligned hackers used AI on ConnectWise

A hacking group Microsoft calls “a China-state aligned actor” used an open-source AI agent framework named ARTEX to automate attacks on hundreds of organizations, Microsoft says. After stolen ConnectWise app credentials gave it a way in, the group tried to sign in to 2,250+ tenants, Microsoft says. The company laid out the campaign Oct. 21.

Microsoft tracks the group as Storm-0940. It “assesses” the group was behind the ConnectWise Cloud Backup compromise, the incident at the service formerly called SkyKick. Microsoft says the group has used ARTEX since as early as September. In several cases, the time from first targeting to privileged cloud access was under three hours.

What ARTEX is: ARTEX is an open-source penetration testing framework that can use any AI model, Microsoft says. It is a multi-agent system written in Go with a Next.js front end. Its AI agents run a test from reconnaissance through data exfiltration with little human input. They log what they find in a graph. Microsoft says actors in several regions use it.

What the agents did: Storm-0940 used ARTEX to speed up scanning, password spraying and abuse of OAuth apps, Microsoft says. Using stolen credentials for ConnectWise cloud apps, the agents signed in to Microsoft 365 customer environments that had already trusted those apps. No user had to sign in. In some tenants, the agents went on to run Microsoft Graph reconnaissance, change app credentials for persistence and alter groups and privileged roles, Microsoft says.

Before that, from Oct. 10 to 14, a Storm-0940 address sprayed passwords at 327 accounts across eight organizations, Microsoft says. It logged more than 151,000 failed sign-ins, peaking Oct. 11 at 2,900 failures a minute. None succeeded.

Microsoft says no flaw in its own products was involved. It adds that a successful sign-in “does not necessarily indicate” data was accessed or taken.

What the others found: ConnectWise says it found the problem Oct. 14 and posted its first advisory Oct. 16. It disabled seven app identities Oct. 17. It says stored backups remain “encrypted, isolated and preserved.” Its Oct. 21 update says “a China state-aligned group” appears responsible, based partly on Microsoft’s intelligence. Whether a product vulnerability played a role “has not been established,” ConnectWise says.

Security firm Huntress says it saw sign-in activity from an address tied to the attack in almost 1,000 tenants, with over 300 succeeding. In one tenant, a ConnectWise Teams app made itself Global Administrator and added secrets to two other apps. Huntress says it has not tied that step to the same operator. In two tenants it reviewed closely, it found no mail or file tampering. But Graph directory reads leave no audit record, it notes.

Expel says the same infrastructure hit one customer’s Okta login with no ConnectWise app involved. The attacker created five accounts of its own. Expel says the shared address is its only link and does not prove ARTEX was used.

Our read: The AI angle here is about speed, not new tricks. By Microsoft’s account, ARTEX ran familiar moves: spraying passwords, abusing trusted apps and granting itself roles. What changed is tempo. Under three hours to privileged access leaves defenders little time, even when alerts fire. The bigger lesson is the supply chain. One backup vendor’s credential reached every tenant that trusted it. Read the numbers carefully. 2,250+ is attempted sign-ins, not breaches. Huntress counts over 300 successful sign-ins in its own view. Neither Microsoft nor Huntress has shown data theft, and Huntress says Graph directory reads leave no audit record. Huntress also stops short of pinning the admin-role changes on the same actor. The China tie rests on Microsoft’s assessment, which ConnectWise repeats. ARTEX being open source cuts both ways. Defenders can study it. Attackers already are.

What’s next: ConnectWise targeted phased partner onboarding for Monday, starting with restores from existing backups. Microsoft and ConnectWise tell customers to keep affected apps disabled, not deleted, until ConnectWise says otherwise. Turning off the vendor app does not remove secrets planted on other apps, Huntress and Expel warn. Both firms say to review app credentials added since Oct. 13.

Sources: Microsoft, ConnectWise, Huntress, Expel