AI agents sped up an attack through ConnectWise: 2,900 login attempts a minute

On Oct 21, Microsoft linked the ConnectWise breach to a group it considers China-linked: Storm-0940 used ConnectWise's cloud backup to get credentials for multi-tenant applications. The group worked with ARTEX, an open-source automated pentesting framework that runs several LLM agents, and tried to log into more than 2,250 Microsoft 365 tenants.