Stolen app keys let AI agents sign in as software at 2,250 tenants

Cloud software firm ConnectWise has paused several of its online services after security researchers found that automated AI agents accessed over 2,250 customer accounts. Microsoft attributes the breach to Storm-0940, a threat group aligned with the Chinese state, which used an open-source tool to speed up its intrusion.

The incident began when attackers obtained stolen credentials for ConnectWise applications. These credentials allowed the AI agents to log in as the software itself, bypassing standard user login requirements. Microsoft described the tool, ARTEX, as a system of language model-driven agents that perform autonomous penetration tests. The agents operated continuously with minimal human oversight, accelerating the scanning and password spraying phases of the attack.

Storm-0940 has been active since 2021. In this campaign, the group targeted 14 industries, including aerospace, defense, semiconductors, and government entities. Microsoft noted that the attack did not originate from a flaw in its own products but from the compromise of the ConnectWise application keys. A separate password-spraying effort hit 327 accounts across eight organizations, generating over 151,000 failed logon attempts. At its peak on Oct. 11, the spray reached 2,900 attempts per minute, with 98% of the activity resulting in account lockouts.

The use of stolen app credentials proved more effective than the password spray. Using four specific credentials, the AI agents recorded more than 200 sign-ins in under four minutes. Within affected tenants, the agents performed directory operations and changed privileged roles. Security firm Huntress observed one tenant on Oct. 15 where an app added itself to the Global Administrator role. By Oct. 16, Huntress confirmed unauthorized sign-ins at 162 tenants. A day later, the count reached nearly 1,000 Entra tenants with activity from the attacking IP address, with more than 300 sign-ins successful.

The attackers moved through the tenant list in a sorted order, with actions occurring seconds apart. Huntress described the pattern as a script working from a target list. The use of ARTEX distinguishes this campaign from traditional attacks, as the framework can operate with various AI models. Public reports this month linked the tool to breaches at South Korean financial institutions. The developer of ARTEX, known as Autumn-27, announced on GitHub that the project would stop receiving updates and become closed source.

ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management to contain the issue. The company has begun a phased restoration process expected to take several days. It reported no indicators that partner backup data was compromised. Microsoft advised customers to keep affected app connections disabled until formal restoration instructions are issued.

Microsoft stated that a successful sign-in does not guarantee that data was accessed or taken. The company urged customers to review activity logs from this month where possible. The phased restoration of ConnectWise services is currently underway.