AI Hackers Breach Software Used by Mid-Atlantic Firms

For many businesses in the Mid-Atlantic, the security landscape has shifted overnight. A large-scale cyberattack targeted a popular management tool used by thousands of organizations. The threat actors used artificial intelligence to speed up their intrusion, reaching high-level access in some cases within three hours. This rapid timeline leaves little room for IT teams to react before significant damage occurs.

Microsoft confirmed that a group known as Storm-0940, aligned with the Chinese state, orchestrated the attack. They exploited a vulnerability in ConnectWise, a multi-tenant application. By stealing credentials for this app, the hackers bypassed standard user logins. They attempted sign-ins across more than 2,250 Microsoft 365 tenants. The group targeted sectors including aerospace, defense, semiconductors, government, and think tanks.

The attack relied on ARTEX, an open-source framework for automated penetration testing. This system uses large language models to conduct autonomous tests with minimal human input. It accelerated scanning, password guessing, and abuse of application credentials. The agents worked continuously, reducing the time defenders had to detect and respond. Microsoft noted that the breach did not stem from a flaw in their own systems.

Automated password spraying also targeted 327 accounts across eight organizations. This resulted in over 151,000 failed login attempts. On October 11, the attack peaked with 2,900 attempts per minute. Nearly 98% of these attempts were locked out. However, using stolen app credentials, the AI agents successfully signed into customer networks from the same IP range. Some tenants saw over 200 sign-ins in under four minutes using just four sets of credentials.

Security firm Huntress observed an app adding itself to the top administrator role in one tenant on October 15. The group planted new secrets set to expire in 2028. By October 16, unauthorized sign-ins were confirmed for 162 tenants. The following day, nearly 1,000 tenants showed activity from the attacking IP. More than 300 of these sign-ins were successful. The sequential nature of the attacks suggested a script working from a pre-defined list.

ConnectWise suspended several services as a precaution, including Cloud Backup and SaaS Security. The company has begun a phased restoration process, which is expected to take several days. There are no current indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until further notice. They recommend reviewing activity logs from this month to identify any suspicious behavior.

The developer of the ARTEX tool has announced the project will no longer be updated and will become closed source. This follows public reports linking similar AI-driven tools to breaches at South Korean financial institutions. CrowdStrike suggested the suspect in those separate cases was likely based in China. For now, the uncertainty remains over exactly how many tenants were fully compromised and how the initial ConnectWise credentials were stolen.