Microsoft Pins ConnectWise Breach on AI-Driven Group Storm-0940

Microsoft says a China-aligned hacking group called Storm-0940 is responsible for a major attack on the ConnectWise platform, using an open-source AI tool to break into customer accounts. The company revealed that the attackers gained unauthorized access to a multi-tenant ConnectWise application and then attempted to sign in to more than 2,250 Microsoft 365 tenants. In some cases, the group managed to secure privileged access less than three hours after they first started targeting an organization.

The operation relied on a penetration testing framework named ARTEX, which Microsoft describes as "a system of LLM-driven agents that run an autonomous penetration test." Because the tool can scan for weaknesses, guess passwords, and abuse OAuth applications without needing a human operator, it is capable of working around the clock. Microsoft stressed that this specific campaign did not exploit a vulnerability in its own products or services.

The attackers used stolen credentials associated with ConnectWise apps to authenticate as the applications themselves, bypassing the need for a user login. This method allowed them to sign in to customer tenants rapidly from a single IP address, recording over 200 sign-ins in under four minutes. Once inside, the group attempted to change passwords, identities, groups, and privileged roles. Security firm Huntress noted that in at least one case on Oct. 15, an application added itself to the Global Administrator role.

While the attack on application credentials was successful, a separate effort to guess user passwords failed. The group targeted 327 accounts across eight organizations, generating more than 151,000 failed login attempts. At the peak of this activity on Oct. 11, the attackers were making 2,900 attempts per minute, but they never successfully logged in. Almost 98% of that specific activity was locked out.

Huntress reported that by Oct. 16 it had confirmed unauthorized sign-ins at 162 tenants. A day later, it counted nearly 1,000 Microsoft Entra tenants showing activity from the attacking IP address, with more than 300 of those sign-ins succeeding. The attackers moved through tenant lists in sorted order just seconds apart, suggesting they were running a script based on a prepared target list.

After detecting the intrusion, ConnectWise suspended several services, including Cloud Backup, SaaS Security, and Cloud Management, as a precaution. The company has started a phased restoration that is expected to take several days. ConnectWise stated that it currently has no indications that partner backup data was compromised, though Microsoft advised customers to keep affected app connections disabled until formal restoration instructions are issued.