China-linked hackers used AI to attack over 2,000 Microsoft 365 tenants

Who is affected

Microsoft said the attackers targeted more than 2,250 Microsoft 365 tenants using credentials stolen from a ConnectWise cloud backup application. The campaign spanned sectors including aerospace, defence, energy, financial services, government, semiconductor and technology. Most attempts failed, but the group achieved privileged cloud access at several organisations in a short time CSO Online↗ (opens in a new tab).

How the attack worked

The threat actor, tracked by Microsoft as Storm-0940 and linked to China, compromised a ConnectWise cloud backup app. Using credentials taken from this breach, they used an open-source agentic AI framework called ARTEX to automate attacks. ARTEX is a multi-agent large language model (LLM) system that can run offensive security tasks with little human input. The attackers made up to 2,900 sign-in attempts per minute across 2,250 tenants. In some cases, they gained privileged cloud access in under three hours.

The attackers authenticated to Microsoft 365 environments using the identities of multiple ConnectWise cloud applications that already had access. This bypassed the need for interactive user sign-ins. Once inside, the agents performed reconnaissance, changed application credentials to maintain persistence, and altered identities, groups and privileged roles. These changes could act as a backdoor even after the original app was remediated.

The response

ConnectWise published an advisory on 16 October about attempted unauthorised access involving its Cloud Backup product and later updated its guidance. Microsoft advised customers to keep affected ConnectWise connections disabled until further instructions and to avoid deleting enterprise applications as a first step. Instead, organisations should search for affected application IDs, preserve relevant logs, and review activity from at least 15 October, or earlier if possible. Microsoft also warned that the presence of an affected application or successful authentication does not always mean data was accessed or stolen.

What experts say

Yih Khai Wong of IDC Asia/Pacific said the attack's speed was beyond what human analysts can handle. He recommended automating containment actions like disabling credentials and revoking tokens when suspicious activity is detected. Yash Kadakia of Security Brigade pointed out that third-party applications can have powerful permissions and may not be as tightly controlled as employee logins. He advised treating vendor integrations like privileged accounts, with minimum permissions, continuous monitoring, and regular access reviews. Both experts stressed that defenders should focus on what an identity is doing, not just whether it is controlled by a human or AI.

What you should do

Organisations using ConnectWise cloud products should follow Microsoft's and ConnectWise's latest guidance. Disable affected connections, review access logs, and search for affected application IDs. Regularly review and limit third-party app permissions, and ensure you have a tested process for revoking access when needed. Monitor for unusual activity, especially changes to credentials or privileged roles.