AI Agents Breach 2,250 Tenants

More than 2,250 Microsoft 365 tenants were targeted for sign-in attempts by a China-state-aligned hacking group known as Storm-0940. According to Microsoft, the attackers utilized ARTEX, an open-source agentic AI penetration testing framework, to execute a large-scale supply chain attack through ConnectWise. By leveraging stolen credentials for multi-tenant applications, the group bypassed interactive user sign-ins, allowing their AI agents to authenticate directly as the apps themselves. In some cases, the intruders achieved privileged access within three hours of first targeting a victim.

The campaign, which has been active since 2021, primarily targeted industries including aerospace, defense, semiconductors, government, and think tanks. Microsoft confirmed that the breach did not stem from vulnerabilities in its own systems but rather from unauthorized access to the ConnectWise application. The attackers also conducted automated password spraying, targeting 327 accounts across eight organizations with over 151,000 failed logon attempts, though none of these brute-force efforts succeeded.

The operation peaked on October 11, when the password spraying reached 2,900 attempts per minute, resulting in over 111,000 failures in a single day. While nearly 98% of these attempts were locked out, the AI agents successfully leveraged ConnectWise app credentials to sign into customer tenants. From the same IP range, the group executed more than 200 sign-ins in under four minutes using just four application credentials. This rapid sequence, occurring seconds apart, indicated a scripted approach working from a predefined target list.

Security firm Huntress observed the agents performing advanced operations within tenants, including directory reconnaissance and modifying privileged roles. In one specific incident on October 15, an application added itself to the top administrator role, triggering alerts for self-assignment of Global Administrator privileges. The attackers also planted new secrets set to expire in 2028. By October 16, Huntress confirmed unauthorized sign-ins for 162 tenants, a number that surged to nearly 1,000 Entra tenants with activity from the attacking IP by the following day, with over 300 sign-ins succeeding.

The use of ARTEX marked a shift in attack methodology, as the framework employs LLM-driven agents to run autonomous penetration tests with minimal human interaction. This automation accelerates scanning, reconnaissance, and OAuth abuse, leaving defenders little time to react. Public reports this month have linked similar AI-driven techniques to breaches at South Korean financial institutions, with CrowdStrike noting the likely use of Anthropic’s Claude Code in those separate incidents. The developer of ARTEX, known as Autumn-27, announced on GitHub that the project would no longer be updated and would transition to closed source.

ConnectWise has suspended its Cloud Backup, SaaS Security, and Cloud Management services as a precaution while it conducts a phased restoration expected to take several days. The company reports no current indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review recent activity logs where possible, noting that a successful sign-in does not automatically confirm data exfiltration.