AI Agents Storm 2,250 Tenants in Record-Breaking Supply Chain Breach

Microsoft has disclosed that a China-aligned threat group known as Storm-0940 deployed an open-source artificial intelligence framework to execute a sophisticated supply chain attack on ConnectWise. The group utilized ARTEX, a system of large language model driven agents, to conduct autonomous penetration testing after gaining unauthorized access to the multi-tenant application. This operation resulted in attempted sign-ins to more than 2,250 Microsoft 365 tenants using stolen ConnectWise application credentials. The speed of the intrusion was notable, with some attacks achieving privileged access in less than three hours after the initial targeting began.

The deployment of autonomous agents significantly accelerated the reconnaissance and scanning phases of the attack. According to Microsoft, the ARTEX framework allowed the attackers to work around the clock with minimal human interaction, creating a pace that left defenders with little time to detect and respond. The agents executed password spraying campaigns against 327 accounts across eight organizations, generating over 151,000 failed logon attempts without any successes. This automated approach streamlined the process of exploiting OAuth applications and testing various entry points into the affected networks.

The scale of the automated password guessing peaked on October 11, when the system logged 2,900 failed attempts per minute. By the end of that day, there were more than 111,000 total attempts, with 48 specific accounts experiencing over 1,000 failures each. Although nearly 98 percent of this activity resulted in account lockouts, the attackers maintained momentum by leveraging the identities of multiple ConnectWise cloud apps. They signed into customer tenants from the same IP range, recording more than 200 sign-ins in under four minutes using just four distinct application credentials.

Inside the compromised tenants, the agents performed a variety of administrative tasks including Graph and directory operations, reconnaissance, and modifications to app credentials and privileged roles. In one specific case on October 15, the security firm Huntress observed an application adding itself to the top administrator role, a behavior that triggered Microsoft Defender alerts for self-assigned Global Administrator roles. The attackers also planted new secrets configured to expire in 2028. By October 16, Huntress confirmed unauthorized sign-ins for 162 tenants, a number that rose to nearly 1,000 Entra tenants with activity from the attacking IP the following day.

The systematic nature of the breach was evident in the sorted order of tenant sweeps, which occurred just seconds apart, indicating a script working from a predefined target list. Storm-0940, active since 2021, targets industries such as aerospace, defense, semiconductors, government, and think tanks. Microsoft clarified that the incident did not stem from a vulnerability in its own systems, products, or services. The use of ARTEX is not unique to this group, as public reports this month linked the framework to breaches at South Korean financial institutions, with CrowdStrike suggesting the suspect in those cases was also based in China.

The developer of ARTEX, who uses the handle Autumn-27 on GitHub, announced that the project would no longer be updated and would transition to closed source. This development follows the framework's recent prominence in security circles. Meanwhile, ConnectWise has taken precautionary steps to mitigate the impact of the breach. The company suspended its Cloud Backup, SaaS Security, and Cloud Management services and has begun a phased restoration process expected to take several days. There are currently no indicators that partner backup data was compromised.

Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review activity logs from this month where possible. The company notes that a successful sign-in or an affected app does not necessarily mean data was accessed or exfiltrated. This incident highlights the growing efficacy of AI driven penetration testing tools in modern cyber operations. As threat actors in multiple regions adopt these technologies, the window for detection and response continues to shrink, necessitating faster automated defenses for enterprise environments.