Supply Chain Breach: AI Agents Storm 2,250 Tenants

More than 2,250 Microsoft 365 tenants faced attempted sign-ins from a coordinated campaign that leveraged artificial intelligence to move faster than traditional human hackers. This massive supply chain attack, attributed to a China-state-aligned group known as Storm-0940, exploited unauthorized access to ConnectWise, a multi-tenant application. The intruders used stolen credentials from ConnectWise apps to authenticate into customer environments without requiring interactive user logins. In some cases, the attackers reached privileged access levels in less than three hours after initial targeting began.

The core of this operation was the use of ARTEX, an open-source framework designed for agentic AI penetration testing. Microsoft describes ARTEX as a system where large language model driven agents run autonomous tests. This technology accelerated the process of scanning networks, conducting reconnaissance, and performing password spraying. The agents operated continuously with minimal human intervention, creating a pace that left defenders with very little time to detect and respond to the intrusion. The group targeted industries including aerospace, defense, semiconductors, government, and think tanks, with 14 specific sectors listed in the report.

Alongside the use of stolen application credentials, the attackers launched an automated password guessing campaign. This effort targeted 327 accounts across eight organizations, resulting in over 151,000 failed logon attempts. Notably, none of these password guesses were successful. At its peak on October 11, the spray generated 2,900 attempts per minute. For that single day, there were more than 111,000 attempts, with 48 accounts experiencing over 1,000 failures each. Almost 98% of this activity resulted in account lockouts, indicating that the brute force approach alone was not the primary method for gaining entry.

The more successful tactic involved the AI agents signing in to customer tenants using the credentials of the compromised ConnectWise cloud apps. From the same IP range, the agents executed more than 200 sign-ins in under four minutes using just four application credentials. Within these tenants, the attackers performed directory operations, conducted reconnaissance, and changed app credentials. They also modified identities, groups, and privileged roles. In one specific tenant on October 15, security firm Huntress observed an app adding itself to the top administrator role, a behavior that triggered Microsoft Defender alerts for self-assigned Global Administrator roles.

The attackers also planted new secrets set to expire in 2028. By October 16, Huntress had confirmed unauthorized sign-ins for 162 tenants. A day later, nearly 1,000 Entra tenants showed sign-in activity from the attacking IP, with more than 300 of those sign-ins succeeding. The pattern of the attack, which swept through tenants in sorted order at intervals of a few seconds, suggested that a script was working from a pre-defined target list. This systematic approach highlighted the efficiency of the automated framework in managing the scale of the breach.

It remains uncertain how the initial ConnectWise credentials were stolen or exactly how many tenants were fully compromised. Microsoft clarified that the activity did not result from a compromise or vulnerability in its own systems or services. The distinction is important for understanding the attack vector, which relied on a third-party application rather than a flaw in the core identity platform. The use of ARTEX marks a shift in how threat actors operate, as the framework can utilize any AI model. Public reporting this month has linked similar technology to breaches at South Korean financial institutions, where the suspect allegedly used ARTEX with Anthropic’s Claude Code.

The developer of ARTEX, who uses the handle Autumn-27, announced on GitHub that the project would no longer be updated and would transition to closed source. This change may affect future availability of the tool for other threat actors. ConnectWise has acknowledged the unauthorized access and suspended its Cloud Backup, SaaS Security, and Cloud Management services as a precaution. A phased restoration process has begun, with recovery expected to take several days. There are currently no indicators that partner backup data was compromised, though Microsoft advises customers to keep affected app connections disabled until formal instructions are issued.

For non-experts, this incident illustrates how AI agents can compress the timeline of a cyberattack from days to hours. The ability to run autonomous penetration tests at scale means that defenders must now prepare for attacks that move at machine speed. While the specific details of how the initial foothold was gained remain unclear, the impact on thousands of organizations is immediate. The open questions surrounding the number of truly compromised tenants and the long-term effects of the planted secrets will require further investigation by both Microsoft and affected customers.