Chinese Spies Used AI Tool and Stolen ConnectWise Credentials to Target 2,250 Microsoft 365 Tenants

Microsoft has attributed the ConnectWise security incident to Storm-0940, a China-linked espionage group active since at least 2021. ConnectWise had earlier shut down its Cloud Backup, SaaS Security, and Cloud Management services after finding unauthorised access to application identities, but it did not say who was responsible. Microsoft says the attackers used an open source AI penetration-testing tool called ARTEX to automate much of their work, and in some cases went from choosing a target to gaining privileged cloud access in under three hours.

The group has traditionally relied on password spraying and exploiting internet-facing applications. Between October 10 and 14, it made more than 151,000 failed sign-in attempts against 327 accounts at eight organisations, with no successful logins observed. The attackers then shifted to compromised ConnectWise application identities. These credentials let them exploit permissions customers had already granted to ConnectWise services, without needing an interactive user login.

Using ARTEX, Storm-0940 tried to authenticate against more than 2,250 Microsoft 365 tenants, at times reaching 2,900 attempts a minute. Microsoft also saw AI-accelerated activity through Microsoft Graph, including reconnaissance, changes to application credentials, and attempts to modify privileges. These steps could let attackers stay in an environment even after the original credentials were revoked. Targets included government agencies, defence contractors, banks, manufacturers, and tech firms.