AI Agents Exploit ConnectWise to Target 2,250 Microsoft 365 Tenants

Key Takeaways

• A China-aligned threat group, Storm-0940, utilized AI agents and compromised ConnectWise credentials to target over 2,250 Microsoft 365 tenants.
• The attacks leveraged existing trust relationships with ConnectWise applications, allowing threat actors to authenticate as applications and bypass traditional user-based multi-factor authentication.
• Microsoft’s ARTEX framework, an AI-driven penetration testing tool, facilitated automated reconnaissance, authentication attempts, and cloud persistence.
• While the campaign targeted a significant number of tenants, it does not confirm a breach for each, as activity logs for Microsoft Graph reads were often missing.
• Organizations should prioritize monitoring for anomalous application behavior, unexpected credential changes, and powerful role assignments, alongside enabling comprehensive logging.

China-Aligned Group Leverages AI Agents in Supply Chain Attack Against Microsoft 365 Tenants

A sophisticated campaign attributed to the China-state-aligned group Storm-0940 has utilized AI agents and stolen ConnectWise application credentials to attempt unauthorized access to more than 2,250 Microsoft 365 tenants. Microsoft’s detailed technical investigation report highlights the role of the group’s ARTEX framework in accelerating critical phases of the attack, including reconnaissance, authentication attempts, and maintaining cloud persistence. It is important to note that the reported targeting count reflects attempts, not necessarily successful breaches of every tenant.

The attack vector exploited pre-existing permissions that customers had granted to legitimate ConnectWise applications. This approach allowed attackers to authenticate as applications, effectively circumventing interactive password prompts and standard user-based multi-factor authentication (MFA) without directly compromising Microsoft’s authentication infrastructure. Earlier reports had already documented unauthorized sign-ins across 173 partner and customer tenants due to compromised ConnectWise backup credentials.

Researchers from Huntress identified the initial credential abuse and provided an in-depth technical analysis on October 26. Their findings corroborate Microsoft’s assessment, though they do not independently confirm AI involvement. The Huntress report primarily focuses on detailing malicious application activity and the attack tooling employed, rather than identifying a new malware family.

The ARTEX Framework and Automated Attack Execution

ARTEX is described by Microsoft as a penetration-testing framework designed to orchestrate multiple AI agents. This framework is capable of automating a wide range of tasks, from initial reconnaissance to data exfiltration, while simultaneously constructing a comprehensive map of discovered assets and identified vulnerabilities. In this specific campaign, the stolen application credentials provided access through existing customer trust relationships, rather than exploiting a newly discovered Microsoft vulnerability.

Huntress observed the majority of the malicious activity on October 15, concentrated within a window of less than 14 hours. During this period, an automated sweep processed nearly 1,000 tenants in ascending identifier order. Distinct bursts of activity also showed approximately 100 failed token requests sent within 10 seconds, indicating the operation of parallel workers that did not wait to evaluate each response before proceeding.

Further evidence supporting advanced automation involved observed changes between different attack runs. For example, after an initial certificate upload failed due to a thumbprint mismatch, a subsequent run commenced just 55 seconds later, incorporating retry logic. This revised approach included retries after approximately 3.5 and 7.1 seconds, and was then applied to other tenants. These observations provide valuable insight into how the tooling adapted to errors, adding detail to previous coverage of ARTEX attacks against tenants. Huntress also documented instances of secrets being added, removed, and restored, alongside changes to privileged roles. In one notable instance, a Teams application identity successfully assigned itself Global Administrator privileges, illustrating the potential for trusted application access to escalate to full administrative control.

Despite the sophisticated automation, the response was not always consistently immediate. After a Teams service principal was deleted, requests continued every four to eight seconds for an additional 22 minutes. This behavior could be indicative of unattended scripts or background tasks operating within a multi-agent system. Consequently, Huntress assigned a low-to-medium confidence rating to AI involvement based purely on its telemetry, which increased to medium-to-high when considering Microsoft’s direct attribution.

Detection Gaps and Microsoft 365 Protection Strategies

A significant challenge for investigators is the absence of comprehensive Microsoft Graph activity logs. Entra audit records currently do not capture Graph read operations, and Huntress reported that no victim organization they observed had Graph activity logging enabled. This logging gap means that even successful authentication does not definitively establish what information was accessed or exfiltrated. Microsoft also draws a clear distinction between targeting, successful sign-ins, and confirmed data access.

In a separate context, Microsoft’s earlier investigation into password spraying recorded over 151,000 failed logons across 327 accounts within eight organizations, with peak activity reaching 2,900 failures per minute. This rate pertained to the password-spraying phase and should not be conflated with the verified count of successful ConnectWise logins.

While this investigation underscores the emerging threat posed by AI agents, defenders should prioritize focusing on malicious actions rather than making assumptions about AI involvement. Huntress advises implementing alerts for applications that assign themselves powerful roles, unexpected additions of credentials, and any vendor identities exhibiting behavior outside their established patterns. Cross-tenant monitoring is also crucial for detecting campaigns that might appear insignificant when viewed within individual environments but are part of a larger, coordinated attack.

Microsoft recommends that organizations keep affected connections disabled until official restoration guidance becomes available. It is also vital to preserve all evidence before deleting any applications and to conduct thorough reviews of credentials, permissions, and role assignments. Removing the original access route may not be sufficient if credentials have been planted elsewhere. Security teams should enable Graph logging wherever feasible and actively investigate suspicious mailbox or file activity in conjunction with any identity changes.

What You Should Do

• Disable Affected Connections: Immediately disable any ConnectWise connections identified as compromised or potentially affected until official restoration guidance is provided by vendors.
• Preserve Evidence: Before deleting any applications or making significant changes, ensure all relevant logs and forensic data are preserved for investigation.
• Review Credentials and Permissions: Conduct a comprehensive audit of all application credentials, permissions, and role assignments, especially for high-privilege accounts and applications.
• Enable Graph Logging: Where available, enable Microsoft Graph activity logging to capture crucial read operations and improve visibility into potential data access.
• Monitor for Anomalous Behavior: Implement alerts for applications self-assigning elevated roles, unexpected credential additions, and any vendor identities displaying unusual activity patterns.
• Investigate Suspicious Activity: Proactively investigate any suspicious mailbox activity, file access, or identity changes within your Microsoft 365 environment.
• Implement Cross-Tenant Monitoring: For Managed Service Providers (MSPs) and multi-tenant environments, deploy cross-tenant monitoring solutions to detect broader campaign patterns.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.