Storm-0940 Weaponizes AI Framework in ConnectWise Breach, Targets Thousands of Microsoft 365 Accounts
A China-aligned hacking group deployed an open-source AI penetration testing tool to exploit stolen application credentials in a sweeping supply chain attack, gaining access to Microsoft 365 tenants without requiring user authentication.
Brute-force password attacks proved ineffective, yet the attackers succeeded by leveraging credentials that bypassed standard login procedures entirely. Microsoft disclosed that the China-state-aligned group Storm-0940 deployed ARTEX, an open-source framework powered by large language models to conduct autonomous penetration testing, during its extensive ConnectWise supply chain compromise. Following their initial unauthorized entry into the multi-tenant platform, the adversaries initiated login attempts across more than 2,250 Microsoft 365 tenants using stolen ConnectWise application credentials—credentials that granted access without requiring interactive user authentication. In certain instances, the attackers achieved privileged access in under three hours from their initial targeting.
Concurrent with their credential-based assault, the group executed password spraying operations targeting 327 accounts distributed across eight separate organizations. These spray attacks generated over 151,000 failed login attempts but yielded no successful breaches through that vector alone. The deployment of ARTEX, which Microsoft characterized as "a system of LLM-driven agents that run an autonomous penetration test," substantially accelerated the attackers' ability to scan networks, gather reconnaissance data, conduct password spraying campaigns, and abuse OAuth applications. Operating with minimal human oversight, the agents functioned continuously "with little needed human interaction," executing reconnaissance and attacks at speeds that "leaves defenders with little time to detect and respond."
The full scope of the compromise remains unclear. Investigators have not determined the mechanism by which Storm-0940 obtained the ConnectWise credentials, nor have they established a definitive count of how many tenants suffered actual compromise.