AI bots speed up a massive cyberattack on software used by major US industries

Security teams across the United States are facing a new kind of speed problem. A group of hackers has used artificial intelligence to break into the digital accounts of thousands of businesses at a pace that leaves little time for defenders to react. The attack targeted a popular software platform used by many large organizations, and it showed how quickly automated tools can move from a first breach to full control of a system.

The group, known as Storm-0940, has been active since 2021 and is aligned with the Chinese state. Microsoft reported that the hackers used an open-source tool called ARTEX. This framework uses large language models to run penetration tests on their own. It can scan for weaknesses, guess passwords, and abuse application credentials with very little human input. The system can work around the clock, which Microsoft noted leaves defenders with very little time to detect and respond.

The attack focused on ConnectWise, a multi-tenant application used for managing IT services. The hackers stole credentials for this application and used them to sign in to more than 2,250 different Microsoft 365 tenants. Because these were app credentials rather than human logins, the sign-ins did not require a user to actively type a password. In some cases, the attackers reached privileged access roles less than three hours after they first targeted a specific tenant.

Beyond the app-based breaches, the group also engaged in automated password guessing, known as password spraying. They targeted 327 accounts across eight organizations with over 151,000 failed logon attempts. None of these guesses succeeded. The activity peaked on October 11, when the system made 2,900 attempts per minute. While almost 98 percent of these attempts were locked out, the sheer volume showed how efficiently the AI agents could operate.

Using the stolen ConnectWise credentials, the AI agents signed in to customer tenants from the same IP range. In one instance, they made more than 200 sign-ins in under four minutes using just four application credentials. Inside the tenants, the agents performed reconnaissance, changed app credentials, and modified identities and groups. In one specific case on October 15, a security firm observed an app adding itself to the top administrator role. This behavior triggered alerts in Microsoft Defender.

By October 16, the security firm Huntress had confirmed unauthorized sign-ins for 162 tenants. The following day, that number jumped to almost 1,000 Entra tenants with sign-in activity from the attacking IP address, with more than 300 of those sign-ins succeeding. The way the attack moved through the tenants in a sorted order, just seconds apart, suggested that a script was working from a pre-defined target list.

The use of ARTEX is a notable shift from traditional attack methods. Microsoft noted that the tool can use any AI model and that threat actors in multiple regions are now using similar technology. Public reports this month linked the framework to breaches at South Korean financial institutions. The developer of ARTEX, who goes by the handle Autumn-27, announced on GitHub that the project would stop being updated and would become closed source, according to Reuters.

ConnectWise acknowledged the unauthorized access and suspended several of its services, including Cloud Backup and SaaS Security, as a precaution. The company has begun a phased restoration process, with recovery expected to take several days. It has not found indicators that partner backup data was compromised. Microsoft advised customers that an affected app or a successful sign-in does not necessarily mean data was taken, but they should keep affected app connections disabled until formal restoration instructions are issued.

It remains unclear how the initial ConnectWise credentials were stolen or exactly how many tenants were fully compromised. The attack targeted 14 industries, including aerospace and defense, semiconductors, government, and think tanks. This incident highlights a growing tension between the speed of AI-driven attacks and the ability of human security teams to keep up.