Microsoft Blames China-Aligned Group for AI-Driven Supply Chain Breach

Businesses using ConnectWise services should expect some disruption in the coming days. The company has suspended several of its cloud features to contain a major security breach. It plans to restore these services in phases over the next several days.

Microsoft has identified the attackers as Storm-0940, a group aligned with the Chinese state. The firm says the hackers relied on an open-source framework called ARTEX. This tool uses large language models to run penetration tests on its own. The system allowed the group to scan networks and attempt logins with minimal human oversight.

The attack began when the group accessed a multi-tenant ConnectWise application. They used stolen credentials to authenticate as the application itself. This method bypassed the need for interactive user sign-ins. From there, they attempted to sign in to more than 2,250 Microsoft 365 tenants. In some cases, they gained privileged access within three hours of the initial targeting.

The AI agents worked quickly. They scanned for weaknesses and sprayed passwords at high speeds. They also abused OAuth applications to move through systems. The automation meant defenders had very little time to react. The agents could operate continuously without breaks.

Microsoft clarified that its own core systems were not compromised. The breach did not stem from a vulnerability in Microsoft products. The targeted industries included aerospace, defense, semiconductors, and government agencies. The group has been active since 2021 but has no known industry aliases.

A parallel password-spraying campaign hit 327 accounts across eight organizations. This effort produced over 151,000 failed login attempts. At its peak on October 11, the spray reached 2,900 attempts per minute. Almost 98% of these attempts resulted in account lockouts. No logins were successful in this specific phase.

The takeover of ConnectWise cloud apps proved more damaging. Using four sets of credentials, the agents signed in to customer tenants from the same IP range. They recorded over 200 sign-ins in less than four minutes. They then performed directory operations and changed app credentials and roles. Huntress, a security firm, found that an app added itself to the Global Administrator role at one tenant. It also planted new secrets set to expire in 2028.

By October 16, Huntress confirmed unauthorized sign-ins at 162 tenants. The next day, it counted nearly 1,000 Entra tenants with activity from the attacking IP. More than 300 of those sign-ins were successful. The attackers moved through tenants in a sorted order, suggesting they used a script with a target list.

ConnectWise has suspended Cloud Backup, SaaS Security, and Cloud Management. It says it has no indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until official restoration instructions are issued. The company notes that a successful sign-in does not automatically mean data was stolen. Users should review their logs from this month to check for unusual activity.