AI Agents Target Over 2,250 Microsoft Tenants in Rapid Supply Chain Strike

A hacker group aligned with the Chinese state, designated Storm-0940, deployed an open-source artificial intelligence framework to execute a large-scale supply chain attack against ConnectWise. According to a Microsoft security blog post published on Thursday, the group utilized a tool called ARTEX to automate the penetration of multi-tenant applications. This automated approach allowed the attackers to attempt sign-ins at more than 2,250 Microsoft 365 tenants. By using stolen ConnectWise application credentials that authenticated without interactive user login, the group moved with unusual speed, with some attacks achieving privileged access in under three hours.

The operation relied on ARTEX, a system of large language model driven agents that conduct autonomous penetration tests. Microsoft noted that these agents accelerated scanning, reconnaissance, and the abuse of OAuth applications. The system operates around the clock with minimal human interaction, creating a pace that leaves defenders with very little time to detect and respond. In parallel, the group executed automated password guessing campaigns against 327 accounts across eight organizations. This specific tactic resulted in more than 151,000 failed logons without a single success.

Storm-0940 has been active since 2021 and is described as a developing actor with no known industry aliases. The campaign targeted fourteen industries, including aerospace and defense, semiconductors, government, and think tanks. Microsoft clarified that the activity did not stem from a vulnerability in its own systems or products. The group likely stole the ConnectWise credentials through an unknown method, and it remains uncertain how many tenants were fully compromised.

At its peak on October 11, the password spray campaign generated 2,900 failed attempts per minute, totaling more than 111,000 failures for the day. Although almost 98 percent of this activity was locked out, the attackers successfully leveraged the stolen app credentials. From the same IP range, the AI agents performed more than 200 sign-ins in under four minutes using just four application credentials. Within the affected tenants, the group performed directory operations, reconnaissance, and changes to privileged roles.

Security firm Huntress observed an application adding itself to the top administrator role in one tenant on October 15. This action triggered a Microsoft Defender alert and included the planting of new secrets set to expire in 2028. By October 16, Huntress confirmed unauthorized sign-ins for 162 tenants. The following day, nearly 1,000 Entra tenants showed sign-in activity from the attacking IP, with over 300 of those sign-ins succeeding. The sequential nature of the sweep suggested the use of a script working from a target list.

The use of ARTEX distinguishes this incident from many traditional attacks, as the open-source tool can utilize various AI models. Public reporting this month linked similar technology to breaches at South Korean financial institutions, where CrowdStrike suggested the suspect used the framework with Anthropic’s Claude Code. The developer of ARTEX, known as Autumn-27, announced on GitHub that the project would become closed source and cease updates. ConnectWise has suspended several cloud services as a precaution and has begun a phased restoration process, with recovery expected to take several days.

Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued. The company also suggests reviewing activity logs from the current month where possible. While a successful sign-in does not guarantee data was accessed or taken, the rapid pace of the attack highlights the growing threat posed by autonomous AI agents in the hands of state-aligned threat actors.