AI Agents Storm 2,250 Corporate Tenants

More than 2,250 Microsoft 365 tenants faced attempted sign-ins from a coordinated wave of automated attacks this month. The campaign, attributed to a China-state-aligned actor known as Storm-0940, utilized stolen credentials from the multi-tenant application ConnectWise to authenticate as applications rather than interactive users. This method allowed the attackers to bypass standard interactive login checks, creating a significant blind spot for traditional detection systems.

The operation relied on ARTEX, an open-source agentic AI penetration testing framework. By deploying large language model-driven agents, the group automated scanning, reconnaissance, and password spraying. These agents operated continuously with minimal human intervention, accelerating the pace of the attack to a level that left defenders with little time to react. In some instances, the attackers achieved privileged access within three hours of initially targeting a specific organization.

The scale of the automated password spraying was substantial. The agents targeted 327 accounts across eight organizations, generating over 151,000 failed logon attempts without a single success. At its peak on October 11, the spray executed 2,900 attempts per minute, totaling more than 111,000 failures that day. While nearly 98% of this activity resulted in account lockouts, the sheer volume demonstrated the efficiency of the AI-driven approach in overwhelming security controls.

Storm-0940, active since 2021, targeted high-value industries including aerospace, defense, semiconductors, government, and think tanks. Microsoft clarified that the breach did not stem from a vulnerability in its own systems or services. Instead, the compromise originated from unauthorized access to ConnectWise. The attackers used the credentials of multiple ConnectWise cloud apps to sign into customer tenants from the same IP range, recording more than 200 sign-ins in under four minutes using just four application credentials.

Within the compromised tenants, the AI agents performed directory operations, reconnaissance, and changes to identities and privileged roles. Huntress, a security firm, observed one app adding itself to the top administrator role on October 15. This specific behavior triggered Microsoft Defender alerts for application self-assigned Global Administrator roles. The attackers also planted new secrets configured to expire in 2028, indicating an intent for long-term persistence.

By October 16, Huntress confirmed unauthorized sign-ins for 162 tenants. The following day, that number surged to nearly 1,000 Entra tenants showing sign-in activity from the attacking IP address, with over 300 of those attempts succeeding. The sequential nature of the attacks, occurring in sorted order just seconds apart, suggested a script was working from a predefined target list. This systematic approach highlights the precision of the automated tooling employed by the threat group.

The use of ARTEX marks a shift in how threat actors conduct supply chain attacks. The framework, which can utilize any AI model, is being used by groups in multiple regions. Public reporting this month linked similar technology to breaches at South Korean financial institutions, where the suspect allegedly used ARTEX with Anthropic’s Claude Code. In response, the developer of ARTEX, known as Autumn-27, announced on GitHub that the project would become closed source and stop receiving updates.

ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services as a precautionary measure. The company has begun a phased restoration process, with full recovery expected to take several days. There are currently no indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review recent activity logs to assess potential exposure.