2,250 Microsoft tenants targeted in AI-driven breach

Microsoft identified 2,250 tenants as the scale of a supply chain intrusion attributed to Storm-0940, a threat actor aligned with China. The group accessed a multi-tenant ConnectWise application and initiated sign-ins across the Microsoft 365 environment. Some intrusions secured privileged access in less than three hours from the initial targeting.

The attackers relied on stolen credentials belonging to ConnectWise applications. These credentials allowed the intruders to authenticate as the applications themselves, bypassing interactive user sign-ins. Microsoft stated that the group employed ARTEX, an open-source agentic AI penetration testing framework. The system uses large language model agents to conduct autonomous testing, accelerating scanning, reconnaissance, and password spraying.

The campaign targeted 14 industries, including aerospace and defense, semiconductors, government, and think tanks. A parallel password-spraying operation attempted to access 327 accounts across eight organizations. This effort generated more than 151,000 failed logons with no successful entries. On October 11, the spray peaked at 2,900 attempts per minute, with over 111,000 failures recorded that day. Nearly 98 percent of these activities resulted in account lockouts.

The identity takeover of ConnectWise cloud apps proved more effective for the attackers. Using four application credentials, AI agents signed into customer tenants from the same IP range. They recorded more than 200 sign-ins in under four minutes. Within specific tenants, the agents performed Graph and directory operations and modified app credentials, identities, groups, and privileged roles. Security firm Huntress observed one tenant on October 15 where an app added itself to the Global Administrator role. By October 16, Huntress confirmed unauthorized sign-ins at 162 tenants. The following day, the firm counted almost 1,000 Entra tenants with sign-in activity from the attacking IP, with more than 300 successful entries.

The attackers moved through tenants in sorted order, seconds apart. Huntress described the behavior as consistent with a script working from a target list. The use of the ARTEX framework distinguishes this campaign from traditional attacks. The framework can operate with any AI model. Public reporting this month linked the tool to breaches at South Korean financial institutions. CrowdStrike stated the suspect in those attacks was likely based in China and allegedly used ARTEX with Anthropic's Claude Code. ARTEX developer Autumn-27 announced on GitHub that the project would become closed source and would no longer receive updates.

ConnectWise detected the unauthorized access and suspended Cloud Backup, SaaS Security, and Cloud Management services as a precaution. The company began a phased restoration expected to take several days. It reported no indicators that partner backup data was compromised. Microsoft advised customers to keep affected app connections disabled until formal restoration instructions are issued. The company noted that an affected app or successful sign-in does not necessarily mean data was accessed or taken.