AI agents used to hit thousands of Microsoft accounts

A China-state-aligned hacking group used autonomous artificial intelligence agents to launch a sweeping supply-chain attack, attempting to access more than 2,250 Microsoft 365 tenants and, in some instances, reaching privileged access in less than three hours. Microsoft disclosed the campaign in a security blog post this week, detailing how the group, identified as Storm-0940, breached a multi-tenant application associated with ConnectWise and then leveraged stolen credentials to sign in to customer tenants without requiring an interactive user login.

The core of the operation relied on ARTEX, an open-source framework powered by large language model agents that can run an autonomous penetration test. Microsoft described ARTEX as a system that speeds up scanning, reconnaissance, password spraying, and OAuth application abuse. The agents operate continuously with little human interaction, a capability that Microsoft warned leaves defenders little time to detect and respond to intrusions.

The activity targeted industries including aerospace and defense, semiconductors, government, and think tanks, among 14 listed sectors. Microsoft emphasized that the campaign did not stem from a compromise or vulnerability in its own systems, products, or services. The company also noted it is not certain how the ConnectWise credentials were stolen or how many tenants were actually compromised.

The campaign included a large-scale password spraying operation, which generated more than 151,000 failed logon attempts against 327 accounts at eight organizations, with no successful sign-ins. At its peak on Oct. 11, the attempt rate reached 2,900 per minute, totaling more than 111,000 that day. Forty-eight accounts logged more than 1,000 failures each, and almost 98% of that activity was locked out.

With control of application identities for multiple ConnectWise cloud apps, the attacking AI agents signed in to customer tenants from the same IP range using those app credentials. Microsoft reported more than 200 sign-ins in under four minutes using four application credentials. Actions within some tenants included Graph and directory operations, reconnaissance, changes to app credentials, and modifications to identities, groups, and privileged roles.

Security firm Huntress observed an app adding itself to the top administrator role in one tenant on Oct. 15, matching the behavior behind the Microsoft Defender alert "Application self-assigned Global Administrator role." Actions included planting new secrets set to expire in 2028. Huntress confirmed unauthorized sign-ins for 162 tenants by Oct. 16 and, a day later, almost 1,000 Entra tenants with sign-in activity from the attacking IP, with more than 300 succeeding.

The attack's progression through tenants in sorted order, a few seconds apart, suggested "a script working from a target list." Threat actors in other regions are also using the technology. Public reporting this month tied ARTEX to breaches at South Korean financial institutions, and CrowdStrike said the suspect in those separate attacks was likely based in China and allegedly used ARTEX with Anthropic's Claude Code.

ConnectWise said it suspended Cloud Backup, formerly SkyKick, SaaS Security, and Cloud Management as a precaution and has started a phased restoration expected to take several days. It has no indicators to date that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review activity from this month where logs allow.