Hackers used an AI agent to try 2,900 Microsoft 365 logins a minute, and it never stops for smoko
By Brett Gavaghan, Founder of Adaptd ·
Microsoft says a China-aligned group used an AI attack tool to break into business cloud accounts, in some cases in under three hours. The way in was an app that already had access.
The short version
- Microsoft says hacking group Storm-0940 used ARTEX, an AI agent tool, to automate attacks on hundreds of organisations from September.
- Microsoft links the group to the ConnectWise Cloud Backup compromise, with sign-in attempts on over 2,250 Microsoft 365 tenants.
- Ask your IT provider whether you use the affected ConnectWise apps and which apps can reach your Microsoft 365.
We've spent two years hearing that AI agents will do the boring work for you. Microsoft has now confirmed that attackers heard the same pitch.
What happened in the ConnectWise attack?
The ConnectWise attack was a supply chain compromise in which Microsoft says the China-aligned group Storm-0940 used ARTEX, an open-source AI agent framework, to break into Microsoft 365 accounts at machine speed. ConnectWise first posted an advisory about unauthorised access to its Cloud Backup service on 16 October.
According to Microsoft's 21 October report, the attackers tried to sign in to more than 2,250 tenants at 2,900 attempts a minute. They got in through apps that already had access, so nobody had to type a password. Some went from first contact to admin access in under three hours.
Who is affected?
Businesses most at risk are those whose IT provider uses the affected ConnectWise apps with Microsoft 365. Many Australian small businesses rely on a managed IT provider, and ConnectWise is a common tool in that world.
Microsoft says this didn't come from a flaw in its own systems, and an affected app doesn't automatically mean your data was taken. It says to keep the affected ConnectWise connections off until ConnectWise says otherwise, and to save evidence before deleting anything.
What should your business do about it?
Your business should ask its IT provider two things: do we use the affected ConnectWise apps, and have you checked our Microsoft 365 against Microsoft's guidance? That includes new app permissions, inbox rules and email forwarding since at least 15 October.
My advice: once that's done, ask for a list of every app that can reach your Microsoft 365. Most businesses have a few they forgot about years ago. It's like the spare key under the mat. Handy, right up until someone else finds it.
The attackers have an AI that works weekends. The least we can do is read the guest list.
Wondering what this means for your business?
That's exactly what the discovery call is for.