2,250 Tenants Hit as AI Agents Breach Cloud Platform in Under Three Hours

More than 2,250 Microsoft 365 tenants faced unauthorized sign-in attempts after a supply chain attack exploited ConnectWise applications. Microsoft identified the perpetrator as Storm-0940, a threat actor it describes as China-state-aligned. The group used ARTEX, an open-source framework of large language model driven agents, to conduct the intrusion. In some cases, attackers achieved privileged access within three hours of first targeting a tenant.

The operation relied on stolen credentials for specific ConnectWise apps. These credentials allowed the attackers to authenticate as the applications themselves, bypassing standard interactive user sign-ins. Microsoft stated that ARTEX accelerated scanning, reconnaissance, and password spraying. The system operated with minimal human intervention, compressing the timeline for detection and response. The exact number of tenants ultimately compromised remains unclear, as does the method used to steal the initial credentials.

Storm-0940 has operated since 2021 without established industry aliases. This campaign targeted 14 industries, including aerospace, defense, semiconductors, government, and think tanks. Microsoft clarified that the breach did not originate from a flaw in its own infrastructure. The group used four application credentials to sign into customer tenants from the same IP range. Within under four minutes, the agents recorded over 200 sign-ins. Inside these tenants, they performed directory operations and modified privileged roles.

A separate password spraying campaign hit 327 accounts across eight organizations. This effort generated more than 151,000 failed logons. At its peak on Oct. 11, the spray rate reached 2,900 attempts per minute. Nearly 98% of these attempts resulted in account lockouts. Forty-eight accounts each logged over 1,000 failures. No successes were recorded in this specific vector.

Security firm Huntress tracked the intrusion's progression. On Oct. 15, it observed one tenant where an app added itself to the Global Administrator role. The attackers planted new secrets set to expire in 2028. By Oct. 16, Huntress confirmed unauthorized sign-ins at 162 tenants. On Oct. 17, it counted almost 1,000 Entra tenants with activity from the attacking IP. More than 300 of those sign-ins were successful. The attackers processed tenants in sorted order with seconds between actions, a pattern Huntress attributed to a script working from a target list.

ARTEX is a modular pentest framework that can integrate with various AI models. Public reports this month linked the tool to breaches at South Korean financial institutions. CrowdStrike stated that the suspect in those attacks likely operated from China and used ARTEX with Anthropic's Claude Code. Reuters reported that ARTEX developer Autumn-27 announced on GitHub that the project would stop receiving updates and transition to closed source.

ConnectWise detected the access and suspended Cloud Backup, SaaS Security, and Cloud Management as a precaution. The company has begun a phased restoration expected to take several days. It reports no indicators that partner backup data was compromised. Microsoft advised customers to keep affected app connections disabled until restoration instructions arrive. It also recommended reviewing activity logs from this month where available.