How AI Agents Helped Hackers Break Into Business Software

Businesses that rely on remote access tools may be facing a new layer of risk due to a sophisticated cyberattack. Microsoft has revealed that a group of hackers used artificial intelligence to breach a popular software platform, giving them a fast entry point into thousands of corporate networks. For ordinary people and small business owners, this event highlights how quickly attackers can now move through systems to find sensitive data or administrative controls.

The incident involves a threat actor known as Storm-0940, a group aligned with the Chinese state that has been active since 2021. This attack did not begin with a simple virus or a forgotten password. Instead, the hackers stole credentials for specific applications within the ConnectWise platform. They then used an open-source framework called ARTEX to automate the entire intrusion process. This allowed them to scan for weaknesses and test access rights without needing a human operator to guide each step.

The scale of the operation was significant. The attackers attempted to sign into more than 2,250 different Microsoft 365 tenants. In some cases, they gained privileged access within three hours of starting their targeting. The AI agents worked around the clock, speeding up tasks like password testing and scanning for security gaps. This relentless pace left defenders with very little time to notice the unusual activity and respond before the attackers moved deeper into the systems.

A separate effort involved a massive password spray, where the hackers tried to guess passwords for 327 accounts across eight organizations. This resulted in over 151,000 failed login attempts, most of which were eventually locked out. However, the application takeover proved more effective. Using just four stolen credentials, the AI agents recorded more than 200 sign-ins in less than four minutes. They then changed settings, added new security keys, and even granted themselves the highest level of administrative access in some instances.

Security firm Huntress tracked the progress of the attack, confirming unauthorized sign-ins at more than 1,000 tenants by mid-October. The attackers moved through the list of targets in a sorted order, suggesting they were using a script to work through a predefined list. This methodical approach allowed them to maintain control over the compromised applications while attempting to hide their tracks.

ConnectWise has suspended several services as a precaution, including Cloud Backup and SaaS Security. The company has begun restoring services in phases and reports no signs that partner backup data was stolen. Microsoft advises customers to keep affected app connections disabled until further notice. This incident shows how tools designed to help security teams test their own defenses can be repurposed by attackers to automate and accelerate complex breaches.

The use of ARTEX is notable because it can work with various AI models. Other reports have linked this tool to recent breaches at financial institutions in South Korea. The developer of the framework has announced that it will no longer be updated and will become closed source. For now, the focus remains on how quickly automated agents can navigate complex corporate environments, changing the landscape of digital security for many organizations.