2,250 Tenants: AI Agents Storm Microsoft 365 in Supply Chain Breach
A China-aligned group leveraged autonomous AI agents to probe over 2,200 Microsoft 365 environments, achieving privileged access in some cases within three hours.
By Kavya Kapoor ·
The fastest breach recorded in this campaign occurred in under three hours, a timeline that underscores the rapid escalation of automated threats in enterprise environments. According to details released today, a group known as Storm-0940 utilized AI-driven agents to penetrate more than 2,250 Microsoft 365 tenants following unauthorized access to the ConnectWise platform. The speed of the intrusion, which reached privileged access levels in some instances, highlights a significant shift in how threat actors operate against multi-tenant systems.
Microsoft detailed the incident in a security blog post, identifying the use of ARTEX, an open-source framework for agentic AI penetration testing. The framework employs a system of large language model-driven agents to conduct autonomous tests. By leveraging stolen credentials from ConnectWise applications, the attackers authenticated as the apps themselves, bypassing the need for interactive user sign-ins. This method allowed the agents to scan, perform reconnaissance, and execute password spraying at a pace that leaves defenders with minimal time to react.
The scale of the automated password guessing was substantial, targeting 327 accounts across eight organizations. The campaign generated more than 151,000 failed logon attempts, with no successful logins recorded through this specific method. At its peak on October 11, the password spray activity hit 2,900 attempts per minute, resulting in over 111,000 failures in a single day. Almost 98% of these attempts were locked out, yet the volume of traffic created a significant noise floor for security teams.
However, the most critical impact came from the abuse of OAuth application credentials. With control of multiple ConnectWise cloud app identities, the AI agents signed into customer tenants from the same IP range. In one instance, more than 200 sign-ins were recorded in under four minutes using just four application credentials. Within affected tenants, the agents performed directory operations, changed app credentials, and modified identities and privileged roles. This systematic sweep, moving through tenants in sorted order with seconds between actions, indicated the use of a script working from a predefined target list.
Storm-0940, active since 2021, is described as a China-state-aligned actor without known industry aliases. The group targeted 14 industries, including aerospace, defense, semiconductor, government, and think tanks. Microsoft clarified that the activity did not stem from a vulnerability in its own systems, but rather from the compromise of the ConnectWise application layer. The use of ARTEX is part of a broader trend, with public reporting linking the framework to breaches at South Korean financial institutions earlier this month.
Security firm Huntress observed specific behaviors that triggered Microsoft Defender alerts, such as an application self-assigning to the Global Administrator role in one tenant on October 15. The attackers also planted new secrets set to expire in 2028. By October 16, Huntress had confirmed unauthorized sign-ins for 162 tenants, a number that grew to nearly 1,000 Entra tenants the following day, with more than 300 sign-ins succeeding. This data confirms the widespread reach of the attack despite the high rate of failed password guesses.
In response, ConnectWise suspended several services, including Cloud Backup, SaaS Security, and Cloud Management, as a precaution. The company has initiated a phased restoration process, with recovery expected to take several days. While there are no current indicators that partner backup data was compromised, Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued. The developer of ARTEX, known as Autumn-27, has stated the project will become closed source and will no longer be updated, potentially altering the landscape for future attackers relying on this specific tool.
Key questions remain regarding how the initial ConnectWise credentials were stolen and the exact number of tenants that suffered data access. Microsoft notes that a successful sign-in does not automatically equate to data exfiltration. Organizations are urged to review activity logs from this month where possible to identify any lingering traces of the automated agents.
Source: Tom's Hardware
