Why Microsoft says China-aligned hackers let AI agents run the ConnectWise breach

The scariest number in Microsoft's new threat report is not the 2,250 tenants. It is three hours. That is how long, in multiple cases, Microsoft says it took a China-state aligned group to go from first targeting an organization to holding privileged access to its cloud infrastructure, with AI agents doing much of the legwork.

In a report published October 21, Microsoft Threat Intelligence assessed that the group it tracks as Storm-0940 was behind the recent supply chain compromise of ConnectWise Cloud Backup. The company says the attackers ran their campaign through ARTEX, an open-source penetration testing framework built from LLM-driven agents. The bigger story is what happens when a trusted app with sweeping permissions meets an attacker that never sleeps.

A pen testing tool, pointed the wrong way

Microsoft describes ARTEX as a multi-agent system written in Go with a Next.js frontend that can plug into any AI model. Its agents run an autonomous penetration test "from reconnaissance through data exfiltration with little needed human interaction." Microsoft says threat actors in multiple regions use it.

Storm-0940 is not new. Microsoft says the group has been active since 2021 and has long abused OAuth applications to read email through Microsoft Graph. What changed, by Microsoft's account, is the tempo.

"They can work around the clock, on weekends, and on holidays and attempt multiple breach paths simultaneously." Microsoft Threat Intelligence, on AI agents

The timeline

Microsoft's telemetry lays out a fast sequence:

• October 10 to 14: Infrastructure Microsoft ties to Storm-0940 sprayed passwords at 327 accounts across eight organizations, logging more than 151,000 failed logons and peaking at 2,900 failures per minute on October 11. Microsoft says none of those attempts succeeded.
• October 15: Public reports of the ConnectWise compromise surfaced, with indicators matching the same IP range.
• October 16: ConnectWise posted its first advisory, which included an IP address identical to one used in the spray campaign.
• After that: Using stolen credentials for ConnectWise cloud apps, the agents tried to sign in to more than 2,250 tenants at 2,900 sign-in attempts per minute.

Because those apps had already been granted access by customers, no user ever had to type a password. In some tenants, Microsoft says, the agents moved on to Graph reconnaissance, credential changes on applications and edits to identities, groups and privileged roles. One of the detections Microsoft lists flags an application that assigned itself the Global Administrator role.

Microsoft has not said how many customers were actually breached, according to CyberScoop, and it stresses that a successful sign-in does not necessarily mean data was taken. Still, the company concluded that while most targeting failed, Storm-0940 "achieved privileged cloud persistence at many organizations in a brief time."

Containment is not cleanup

ConnectWise chief executive Manny Rivelo said in a statement reported by Reuters that, based on Microsoft's analysis and the company's own evidence, "it appears that a China state-aligned group was responsible." He also delivered the line every admin should tape to a monitor: containing the affected app connections does "not remove unauthorised access that may have already been established within individual customer tenants."

Microsoft's guidance follows that logic. Keep the ConnectWise app connections disabled until the vendor says otherwise. Preserve evidence before deleting anything. Review service principal sign-ins from at least October 15, and ideally from October 1. Hunt for new credentials, role assignments and consent grants, then revoke and rotate where something looks wrong.

Beijing rejected the framing. A spokesperson for the Chinese Embassy in Washington told Reuters that China "opposes and fights hacking activities in accordance with the law," and opposes "smears and attacks against China under the excuse of cybersecurity issues."

Microsoft executive vice president Igor Tsyganskiy wrote on LinkedIn that a wave of AI-driven attacks has been under way since early October and called ConnectWise "one of many." Pair that with CrowdStrike's recent research on criminal crews talking chatbots past their guardrails, and the picture gets uncomfortable. The weak point here was not a zero-day. It was a backup app that customers had trusted with the keys, and an adversary that could try those keys thousands of times a minute.