ConnectWise Suspends Cloud Services After AI-Driven Breach Targets 2,250 Tenants
Microsoft attributes the attack to a China-aligned group using an autonomous penetration testing framework to compromise identity credentials.
By Kwame Silva ·
Businesses relying on ConnectWise for cloud backup and security management lost access to those tools this week as the company suspended its services. The outage stems from a coordinated cyberattack that exploited stolen application credentials to infiltrate customer environments. ConnectWise has initiated a phased restoration process, a timeline it estimates will last several days.
Microsoft attributed the intrusion to Storm-0940, a threat actor aligned with the Chinese state that has been active since 2021. The group utilized ARTEX, an open-source agentic AI framework designed for autonomous penetration testing. According to Microsoft, the system accelerated scanning, password spraying, and the abuse of OAuth applications by operating with minimal human intervention.
The attackers used four stolen application credentials to authenticate as ConnectWise apps, bypassing interactive user sign-ins. This allowed them to attempt sign-ins across more than 2,250 Microsoft 365 tenants. In some cases, the group achieved privileged access within three hours of the initial targeting. The campaign targeted 14 industries, including aerospace, defense, semiconductors, and government think tanks.
Security firm Huntress identified unauthorized sign-ins at 162 tenants by October 16. By October 17, the count of Entra tenants with activity from the attacking IP address reached nearly 1,000, with more than 300 sign-ins successful. Huntress noted that one tenant recorded an app adding itself to the Global Administrator role on October 15. The attackers also planted new secrets set to expire in 2028.
A separate password-spraying campaign targeted 327 accounts across eight organizations, generating over 151,000 failed logons. On October 11, the peak activity reached 2,900 attempts per minute, yet no logons succeeded. Nearly 98% of these attempts were locked out, indicating that the identity takeover of ConnectWise apps was the primary vector for successful intrusions.
ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management as a precaution. The company stated it has found no indicators that partner backup data was compromised. Microsoft advised customers to keep affected app connections disabled until formal restoration instructions are issued and to review activity from this month where logs permit. The use of ARTEX in this campaign follows public reports linking the framework to breaches at South Korean financial institutions.
