Microsoft ties 2,250 tenant breach to Storm-0940 and AI agents

Microsoft has linked a widespread supply chain attack to Storm-0940, a China-state-aligned threat actor. The group compromised a multi-tenant ConnectWise application and attempted sign-ins at more than 2,250 Microsoft 365 tenants. In some cases, the intrusions reached privileged access less than three hours after the initial targeting began.

The attackers leveraged stolen credentials for ConnectWise apps. This allowed them to authenticate as the applications themselves without interactive user sign-in. Microsoft stated that the group utilized ARTEX, an open-source agentic AI penetration testing framework. The company described ARTEX as a system of large language model-driven agents that conduct autonomous penetration tests. These agents accelerated scanning, reconnaissance, password spraying, and the abuse of OAuth applications.

Storm-0940 has been active since 2021 and lacks known industry aliases. The campaign targeted 14 industries, including aerospace, defense, semiconductors, government, and think tanks. Microsoft clarified that the activity did not originate from a compromise or vulnerability in its own systems, products, or services.

A separate password-spraying effort targeted 327 accounts across eight organizations. This campaign generated more than 151,000 failed logons with no successes. On October 11, the spray peaked at 2,900 attempts per minute. That day, more than 111,000 attempts were made, and 48 accounts logged over 1,000 failures each. Nearly 98% of that activity resulted in lockouts.

The identity takeover of ConnectWise cloud apps proved more effective. Using four application credentials, the AI agents signed in to customer tenants from the same IP range. They recorded more than 200 sign-ins in under four minutes. Within some tenants, the agents performed Graph and directory operations, conducted reconnaissance, and modified app credentials, identities, groups, and privileged roles.

Security firm Huntress observed one tenant on October 15 where an app added itself to the Global Administrator role. This behavior triggered a Microsoft Defender alert. The attackers planted new secrets set to expire in 2028. By October 16, Huntress confirmed unauthorized sign-ins at 162 tenants. A day later, the firm counted almost 1,000 Entra tenants with sign-in activity from the attacking IP, with more than 300 of those sign-ins successful. The attackers moved through tenants in sorted order, seconds apart, suggesting a script working from a target list.

ConnectWise detected the unauthorized access and suspended Cloud Backup, SaaS Security, and Cloud Management as a precaution. The company has begun a phased restoration expected to take several days and reports no indicators that partner backup data was compromised. Microsoft advised customers to keep affected app connections disabled until formal restoration instructions are issued. The company noted that an affected app or successful sign-in does not necessarily mean data was accessed or taken.

ARTEX, which can work with any AI model, sets this campaign apart from traditional attacks. Public reporting this month linked the framework to breaches at South Korean financial institutions. CrowdStrike said the suspect in those attacks was likely based in China and used ARTEX with Anthropic's Claude Code. Reuters reported that ARTEX's developer, known as Autumn-27, stated on GitHub that the project will no longer be updated and will become closed source.