Storm-0940 Harnesses AI Agents to Breach 2,250 Microsoft Tenants via ConnectWise

Storm-0940, a threat group aligned with the Chinese state, executed a broad supply chain attack by leveraging ARTEX, an open-source artificial intelligence framework designed for autonomous penetration testing. According to a recent post on its security blog, Microsoft disclosed that the group gained unauthorized access to the multi-tenant application ConnectWise. Using stolen credentials associated with ConnectWise applications, the attackers bypassed standard interactive user sign-ins, effectively authenticating as the apps themselves. This method allowed the group to attempt sign-ins at more than 2,250 distinct Microsoft 365 tenants, marking one of the more extensive uses of agentic AI in recent cyber operations.

The deployment of ARTEX, described as a system of large language model-driven agents that conduct autonomous penetration tests, significantly accelerated the attack timeline. Microsoft noted that the framework sped up critical phases, including scanning, reconnaissance, password spraying, and the abuse of OAuth applications. The agents operated with minimal human interaction, working continuously at a pace that left defenders with little time to detect anomalies or respond. In some instances, the group reached privileged access levels less than three hours after initially targeting a specific tenant.

Alongside the application credential abuse, the group conducted automated password guessing campaigns, known as password spraying. These efforts targeted 327 accounts across eight organizations, resulting in more than 151,000 failed logon attempts with no successful entries. The activity peaked on October 11, when the password spray mechanism executed 2,900 attempts per minute, all of which failed. For that single day, the total volume of failed attempts exceeded 111,000, with 48 specific accounts logging more than 1,000 failures each. Approximately 98% of this activity triggered account lockouts, suggesting a high degree of automated, brute-force behavior.

Despite the high volume of failed password attempts, the attack’s success relied on the control of multiple ConnectWise cloud application identities. From a consistent IP range, the attacking AI agents used these app credentials to sign into customer tenants. In one rapid burst, more than 200 sign-ins were executed in under four minutes using just four application credentials. Within affected tenants, the agents performed directory operations, reconnaissance, and changes to application credentials, identities, groups, and privileged roles. The sequence of tenant access, occurring in sorted order with only seconds between entries, indicated the use of a script working from a predefined target list.

Storm-0940 has been active since 2021 and is characterized by analysts as a China-state-aligned actor without known industry aliases. The group’s targets in this campaign included 14 organizations across industries such as aerospace, defense, semiconductors, government, and think tanks. Microsoft clarified that the incident did not stem from a vulnerability or compromise within its own systems, products, or services, but rather from the external application ecosystem.

Huntress, a security firm, observed specific behaviors in one tenant on October 15, where an application added itself to the top administrator role. This action triggered a Microsoft Defender alert for an application self-assigning the Global Administrator role. The attackers also planted new secrets configured to expire in 2028. By October 16, Huntress confirmed unauthorized sign-ins for 162 tenants. A day later, the count of Entra tenants showing sign-in activity from the attacking IP rose to nearly 1,000, with more than 300 of those sign-ins succeeding.

The use of ARTEX distinguishes this campaign from traditional attacks. Microsoft noted that the framework is model-agnostic, meaning it can utilize various AI models. Public reporting this month linked the same technology to breaches at South Korean financial institutions, where CrowdStrike identified a likely China-based suspect using ARTEX with Anthropic’s Claude Code. In response to the growing adoption of the tool by threat actors, ARTEX’s developer, known by the handle “Autumn-27,” announced on GitHub that the project would cease updates and transition to a closed-source model, according to Reuters.

ConnectWise acknowledged the unauthorized access and took precautionary steps by suspending its Cloud Backup, SaaS Security, and Cloud Management services. The company has begun a phased restoration process, with full recovery expected to take several days. As of now, ConnectWise reports no indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review activity logs from this month where possible, noting that a successful sign-in does not automatically guarantee data exfiltration.

The incident highlights the evolving nature of supply chain attacks, where the integration of autonomous AI agents reduces the time between initial access and deep compromise. As organizations continue to adopt agentic AI for security testing, threat actors are rapidly mirroring these capabilities to outpace traditional defense mechanisms. The shift of ARTEX to a closed-source model may complicate future analyses of similar attacks, but the immediate impact on the hundreds of affected tenants remains a focus for IT security teams in the coming days.