AI Agents Drive Rapid Breach of 2,250 Microsoft Tenants via ConnectWise Compromise

A China-state-aligned threat group has successfully executed a large-scale supply chain attack against ConnectWise, utilizing autonomous AI agents to breach over 2,250 Microsoft 365 tenants. According to Microsoft’s security division, the actor, designated Storm-0940, deployed ARTEX, an open-source agentic artificial intelligence framework designed for penetration testing. This initiative marked a significant shift in cyberattack methodology, as the group leveraged stolen application credentials to authenticate without interactive user sign-ins, allowing the AI agents to operate continuously with minimal human oversight.

The scale of the operation was substantial, with the attackers attempting sign-ins across more than 2,250 distinct tenants. In a separate automated password spraying campaign, the group targeted 327 accounts across eight organizations, resulting in over 151,000 failed login attempts, though no successful logins were recorded from this specific vector. The deployment of ARTEX accelerated scanning, reconnaissance, and OAuth application abuse. Microsoft noted that the system’s ability to function around the clock left defenders with significantly reduced time to detect and respond to the intrusion. While the precise method of credential theft remains uncertain, the rapidity of the breach was notable, with some tenants achieving privileged access in less than three hours after initial targeting.

Storm-0940, active since 2021, is classified as a developing actor with no known industry aliases. The group’s recent campaign targeted fourteen industries, including aerospace and defense, semiconductors, government entities, and think tanks. Microsoft clarified that the incident did not stem from a vulnerability or compromise within its own systems, products, or services. Instead, the attack vector relied on the unauthorized access to the multi-tenant ConnectWise application, which served as the entry point for the AI-driven agents.

The intensity of the attack peaked on October 11, when the password spraying campaign reached 2,900 attempts per minute, with over 111,000 failures recorded for that day. Approximately 98% of this activity resulted in account lockouts. However, the most critical phase involved the use of four specific ConnectWise cloud application credentials. Using these credentials, the AI agents executed more than 200 sign-ins within four minutes from the same IP range. Within compromised tenants, the agents performed directory operations, reconnaissance, and modifications to app credentials, identities, groups, and privileged roles.

Security firm Huntress observed specific high-level actions on October 15, including an application adding itself to the top administrator role, a behavior that triggered Microsoft Defender alerts. The attackers also planted new secrets configured to expire in 2028. By October 16, Huntress confirmed unauthorized sign-ins for 162 tenants. The following day, nearly 1,000 Entra tenants exhibited sign-in activity from the attacking IP, with more than 300 of those attempts succeeding. The sequential nature of the tenant sweeps, occurring seconds apart, suggested the use of a script working from a pre-defined target list.

The utilization of ARTEX distinguishes this campaign from traditional attacks, as the framework can integrate with various AI models. Public reporting this month linked similar technology to breaches at South Korean financial institutions, with CrowdStrike indicating the suspect in those cases was likely based in China and used ARTEX with Anthropic’s Claude Code. In response to the widespread adoption and exploitation of the tool, the developer of ARTEX, known by the handle Autumn-27, announced on GitHub that the project would cease updates and transition to closed-source status, according to Reuters.

ConnectWise has acknowledged the unauthorized access and has suspended its Cloud Backup, SaaS Security, and Cloud Management services as a precautionary measure. The company has initiated a phased restoration process, with full recovery expected to take several days. To date, there are no indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review activity logs from this month where available. The incident underscores the growing speed and autonomy of AI-driven cyber threats, requiring defenders to adapt their detection and response strategies accordingly.