AI Agents Breached 2,250 Cloud Tenants

Hackers used AI to breach thousands of businesses in under three hours.

Microsoft attributed a large-scale supply chain attack to Storm-0940, a threat actor aligned with the Chinese state. The group targeted ConnectWise, a multi-tenant application that serves various corporate clients. Microsoft says the attackers relied on ARTEX, an open-source framework for agentic AI penetration testing. This tool allowed the group to move faster than traditional human-led operations.

The intruders gained unauthorized access to the ConnectWise application and attempted sign-ins at more than 2,250 Microsoft 365 tenants. In some instances, the attackers achieved privileged access within three hours of the initial target identification. They used stolen credentials belonging to ConnectWise apps to authenticate without interactive user sign-ins. It remains unclear how those specific credentials were obtained or exactly how many tenants were fully compromised.

Microsoft describes ARTEX as a system of large language model driven agents that run autonomous penetration tests. The framework sped up scanning, reconnaissance, and password spraying. It also facilitated the abuse of OAuth applications. These agents operate around the clock with minimal human involvement. This speed leaves defenders little time to detect and respond to the intrusion.

Storm-0940 has been active since 2021 and has no known industry aliases. Microsoft designated it as a developing actor. The campaign targeted 14 industries, including aerospace, defense, semiconductors, government, and think tanks. Microsoft stressed that the activity did not stem from a compromise of its own systems, products, or services.

A parallel password-spraying effort targeted 327 accounts across eight organizations. This produced more than 151,000 failed logons and no successes. At its peak on Oct. 11, the spray reached 2,900 attempts per minute. More than 111,000 failures occurred that day, with 48 accounts each logging over 1,000 failures. Almost 98% of that activity resulted in lockouts.

The identity takeover of ConnectWise cloud apps proved more effective. Using four application credentials, the AI agents signed in to customer tenants from the same IP range. They recorded more than 200 sign-ins in under four minutes. Within some tenants, they carried out Graph and directory operations and changed app credentials, identities, groups, and privileged roles.

Security firm Huntress observed one tenant on Oct. 15 where an app added itself to the Global Administrator role. This behavior triggered a Microsoft Defender alert. The actions included planting new secrets set to expire in 2028. By Oct. 16, Huntress confirmed unauthorized sign-ins at 162 tenants. A day later, it counted almost 1,000 Entra tenants with sign-in activity from the attacking IP, more than 300 of them successful.

The attackers moved through tenants in sorted order, seconds apart. This pattern suggests a script working from a target list. The use of a pentest framework that works with any AI model sets this campaign apart. Threat actors in several regions use the tool, and public reporting linked it to breaches at South Korean financial institutions. CrowdStrike said the suspect in those attacks was likely based in China and allegedly used ARTEX with Anthropic's Claude Code.

ARTEX's developer, who goes by Autumn-27, stated on GitHub that the project will no longer be updated and would become closed source. ConnectWise detected the unauthorized access and suspended Cloud Backup, SaaS Security, and Cloud Management as a precaution. It has begun a phased restoration expected to take several days. The company says it has no indicators that partner backup data was compromised. Microsoft advised customers to keep affected app connections disabled until formal restoration instructions are issued and to review activity from this month where logs permit.