Cloud Breach: AI Agents Compromise 2,250 Microsoft Tenants in Hours

Three hours. That is the window of time attackers had to move from initial targeting to privileged access in some Microsoft 365 environments during a massive supply chain intrusion. Microsoft attributed the breach to Storm-0940, a threat actor aligned with China, which utilized an open-source artificial intelligence framework to accelerate its attack. The group compromised a multi-tenant application from ConnectWise and attempted sign-ins at more than 2,250 tenants.

The intruders exploited stolen credentials belonging to ConnectWise applications. This allowed the system to authenticate as the apps themselves, bypassing the need for interactive user sign-ins. The attack relied on ARTEX, a framework of large language model agents designed to run autonomous penetration tests. Microsoft stated that this technology sped up scanning, reconnaissance, and the abuse of OAuth applications. These agents operated continuously with minimal human intervention, compressing the timeline for detection and response.

Storm-0940 has been active since 2021. The group targeted 14 industries, including aerospace, defense, semiconductors, and government agencies. Microsoft clarified that the attack did not originate from a vulnerability in its own systems. A separate password-spraying campaign hit 327 accounts across eight organizations. This effort generated over 151,000 failed logons. On October 11, the peak activity reached 2,900 attempts per minute, though nearly 98% of these accounts were locked out.

The takeover of ConnectWise cloud apps proved more successful than the password spraying. Using four specific application credentials, the AI agents signed in to customer tenants from a single IP range. They recorded more than 200 sign-ins in under four minutes. Inside these environments, the actors performed directory operations and reconnaissance. They also modified app credentials, identities, groups, and privileged roles.

Huntress, a security firm, observed specific malicious activity on October 15. In one tenant, an application added itself to the Global Administrator role. This action triggered a Microsoft Defender alert. The attackers planted new secrets configured to expire in 2028. By October 16, Huntress confirmed unauthorized sign-ins at 162 tenants. A day later, the firm counted nearly 1,000 Entra tenants with activity from the attacking IP, with over 300 of those sign-ins succeeding. The attackers processed tenants in sorted order with seconds between actions, suggesting they used a script from a target list.

The use of ARTEX distinguishes this campaign from traditional attacks. The framework can integrate with various AI models. Public reporting this month linked the tool to breaches at South Korean financial institutions. CrowdStrike indicated that the suspect in those incidents was likely based in China and used ARTEX with Anthropic's Claude Code. Reuters reported that the developer of ARTEX, known as Autumn-27, announced on GitHub that the project would stop receiving updates and become closed source.

ConnectWise detected the unauthorized access and suspended its Cloud Backup, SaaS Security, and Cloud Management services as a precaution. The company has started a phased restoration process expected to last several days. ConnectWise stated it has no current indicators that partner backup data was compromised. Microsoft advised customers to keep affected app connections disabled until formal restoration instructions are issued. Companies should also review activity logs from this month where possible.

Microsoft noted that an affected app or a successful sign-in does not automatically mean data was accessed or stolen. The company urged customers to maintain a cautious stance during the recovery period. The restoration schedule depends on the complexity of each tenant's environment. ConnectWise will provide further updates as the phased service return progresses.