Supply Chain Breach: AI Agents Target 2,250 Microsoft Tenants

Microsoft has linked a widespread supply chain attack to Storm-0940, a threat group aligned with the Chinese state. The group used an open-source artificial intelligence framework to breach more than 2,250 Microsoft 365 tenants. The intrusion began when attackers accessed a multi-tenant application belonging to ConnectWise.

The attackers relied on stolen credentials for ConnectWise applications. This allowed them to sign in as the software itself, bypassing the need for interactive user login. Microsoft described the tool, known as ARTEX, as a system of large language model driven agents. These agents performed autonomous penetration tests, scanning networks and spraying passwords with minimal human oversight.

Speed defined the operation. Microsoft stated that some intrusions reached privileged access levels in under three hours. The AI agents operated around the clock, leaving security teams little time to detect the activity. The campaign targeted 14 industries, including aerospace, defense, semiconductors, and government think tanks. Microsoft clarified that its own systems and products were not the source of the vulnerability.

A separate password spraying effort targeted 327 accounts across eight organizations. This campaign generated over 151,000 failed login attempts with no successes. The peak activity occurred on Oct. 11, reaching 2,900 attempts per minute. Nearly 98% of these attempts resulted in account lockouts. The high volume of failures suggests a brute-force approach that failed to gain entry.

The identity takeover proved more effective than the spraying. Using four application credentials, the AI agents recorded over 200 sign-ins from the same IP range in under four minutes. Inside these tenants, the agents performed directory operations and reconnaissance. They also modified app credentials, identities, groups, and privileged roles.

Security firm Huntress observed specific malicious behavior on Oct. 15. An app added itself to the Global Administrator role at one tenant. The attackers planted new secrets set to expire in 2028. By Oct. 16, Huntress confirmed unauthorized sign-ins at 162 tenants. The following day, the count rose to almost 1,000 Entra tenants with sign-in activity from the attacking IP. More than 300 of those sign-ins were successful.

The attackers moved through tenants in sorted order, with seconds between actions. This pattern suggests a script working from a target list. The use of ARTEX distinguishes this campaign from traditional attacks. The framework can work with any AI model. Public reports this month linked the tool to breaches at South Korean financial institutions. CrowdStrike indicated the suspect in those cases was likely based in China and used the tool with Anthropic's Claude Code.

ARTEX's developer, known as Autumn-27, announced on GitHub that the project will no longer be updated. The framework will become closed source. ConnectWise detected the unauthorized access and suspended several services as a precaution. These include Cloud Backup, SaaS Security, and Cloud Management. The company has begun a phased restoration expected to take several days.

ConnectWise reports no indicators that partner backup data was compromised. Microsoft advised customers to keep affected app connections disabled until formal restoration instructions are issued. The company cautioned that a successful sign-in does not necessarily mean data was accessed. Customers should review activity from this month where logs permit.