2,250 Tenants Targeted: AI Agents Storm Microsoft Cloud in Supply Chain Breach

Storm-0940, a China-state-aligned threat group active since 2021, orchestrated a massive supply chain attack by deploying automated AI agents to breach customer environments through ConnectWise. Microsoft detailed the operation in a security blog post, revealing that the group utilized ARTEX, an open-source agentic AI penetration testing framework, to execute the intrusion at a speed and scale that overwhelmed traditional defenses. The attack leveraged unauthorized access to the multi-tenant ConnectWise application to launch a widespread campaign against Microsoft 365 environments.

The core of the operation involved stolen credentials from ConnectWise applications, which authenticated directly with Microsoft 365 without requiring interactive user sign-ins. Using these compromised app identities, the AI agents attempted sign-ins at more than 2,250 distinct Microsoft 365 tenants. In several instances, the attackers moved from initial targeting to achieving privileged access in less than three hours. This rapid escalation was facilitated by the autonomous nature of the agents, which operated continuously with minimal human intervention, leaving security teams with very little time to detect and respond to the intrusion.

Alongside the application-based attacks, the group conducted extensive password spraying campaigns. Automated guesses targeted 327 accounts across eight organizations, resulting in more than 151,000 failed logon attempts. Notably, none of these password guesses succeeded. The ARTEX framework accelerated the scanning, reconnaissance, and OAuth application abuse phases of the attack. The system’s ability to work around the clock at a high pace was a key factor in its effectiveness, as it compressed the window for defenders to identify the anomaly.

The peak of the password spraying activity occurred on October 11, when the system executed 2,900 attempts per minute, all of which failed. That day alone saw over 111,000 attempts, with 48 accounts logging more than 1,000 failures each. Approximately 98% of this activity resulted in account lockouts. However, the more significant threat came from the successful sign-ins using the compromised ConnectWise app credentials. From a single IP range, the agents performed more than 200 sign-ins in under four minutes using just four application credentials, sweeping through tenants in a sorted order that indicated a script working from a predefined target list.

Once inside, the attackers performed a variety of operations, including Graph and directory reconnaissance, changing app credentials, and modifying identities, groups, and privileged roles. In one specific tenant on October 15, security firm Huntress observed an application assigning itself to the top administrator role, a behavior that triggered a specific Microsoft Defender alert. The attackers also planted new secrets set to expire in 2028. By October 16, Huntress confirmed unauthorized sign-ins for 162 tenants, and by October 17, the number of Entra tenants showing sign-in activity from the attacking IP had risen to nearly 1,000, with more than 300 of those sign-ins succeeding.

The attack targeted 14 industries, including aerospace and defense, semiconductors, government, and think tanks. Microsoft clarified that the breach did not stem from a vulnerability in its own systems or products, but rather from the compromise of the third-party ConnectWise application. The use of ARTEX represents a shift in threat landscape, as the framework can utilize any AI model. Public reports this month have linked similar technology to breaches at South Korean financial institutions, with CrowdStrike suggesting the suspect in those cases was likely China-based and used ARTEX with Anthropic’s Claude Code.

The developer of ARTEX, known by the handle “Autumn-27,” announced on GitHub that the project would become closed source and would no longer receive updates. This development adds uncertainty to the future of this open-source tool. Meanwhile, ConnectWise has suspended several of its services, including Cloud Backup, SaaS Security, and Cloud Management, as a precautionary measure. The company has begun a phased restoration process, with full recovery expected to take several days, and has reported no indicators that partner backup data was compromised.

Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review activity logs from this month where possible. The incident highlights that a successful sign-in or affected app does not automatically mean data was accessed or exfiltrated. It remains uncertain how many tenants were actually compromised or how the initial ConnectWise credentials were stolen, leaving key questions open as the security community analyzes the impact of AI-driven supply chain attacks.