AI bots help Chinese hackers break into thousands of business networks

The race to detect cyberattacks just got harder because the attackers are now using artificial intelligence that works around the clock. A group of hackers aligned with the Chinese government has deployed AI-driven agents in a massive supply chain attack, targeting thousands of business networks through a widely used IT management tool. The speed and scale of the operation mean defenders have very little time to react, marking a significant shift in how cyber threats are executed.

The incident centers on a group Microsoft identifies as Storm-0940, which has been active since 2021. This actor, which does not have a known industry alias, recently gained unauthorized access to ConnectWise, a multi-tenant application used for IT services. Once inside, the group leveraged stolen credentials from the ConnectWise application to sign in to more than 2,250 Microsoft 365 tenants. Because these sign-ins used application credentials rather than interactive user logins, they often bypassed traditional detection methods that look for human behavior.

To execute this, the hackers utilized ARTEX, an open-source framework designed for automated penetration testing. ARTEX uses large language models to drive agents that perform reconnaissance, password spraying, and abuse of OAuth applications with minimal human interaction. Microsoft notes that this automation significantly sped up the attack process. In some cases, the group reached privileged access levels within less than three hours of initially targeting a victim, a timeframe that leaves security teams with almost no window to intervene.

The attack also involved aggressive password spraying, where the AI agents attempted to guess passwords for 327 accounts across eight organizations. This resulted in more than 151,000 failed logon attempts, though none were successful during this specific phase. At its peak on October 11, the password spraying campaign hit a high of 2,900 attempts per minute. While nearly 98% of these attempts were eventually locked out, the sheer volume overwhelmed some systems. The group also managed to sign in to customer tenants from the same IP range, achieving more than 200 successful sign-ins in under four minutes using just four application credentials.

Security firm Huntress observed some of the specific actions taken within compromised tenants. In one instance on October 15, an application added itself to the top administrator role, triggering a specific alert in Microsoft Defender. The attackers also planted new secrets configured to expire in 2028, likely to maintain long-term access. By October 16, Huntress had confirmed unauthorized sign-ins for 162 tenants, and by the following day, that number had surged to almost 1,000 Entra tenants with activity from the attacking IP, with over 300 sign-ins succeeding. The pattern of the attacks, sweeping through tenants in sorted order seconds apart, suggests the use of a script working from a pre-defined target list.

The use of ARTEX is notable because the framework can utilize any AI model, making it a flexible tool for threat actors in various regions. Public reports this month linked similar technology to breaches at South Korean financial institutions, where CrowdStrike suspected a China-based actor used ARTEX alongside Anthropic’s Claude Code. The developer of ARTEX, known by the handle Autumn-27, has announced that the project will no longer be updated and will become closed source, a move that may impact how other groups utilize the tool in the future.

ConnectWise responded to the breach by suspending several of its services, including Cloud Backup and SaaS Security, as a precautionary measure. The company has begun a phased restoration process, with full recovery expected to take several days. While there are no current indicators that partner backup data was compromised, Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued. This incident highlights how a single vulnerability in a third-party tool can cascade into a widespread threat across an entire ecosystem, especially when amplified by autonomous AI agents.