2,250 Tenants: AI Agents Hit Microsoft 365 via ConnectWise Breach

More than 2,250 Microsoft 365 tenants were targeted for sign-in attempts by a China-state-aligned threat actor, marking a significant escalation in automated supply chain attacks. According to Microsoft’s security blog, the group, identified as Storm-0940, exploited unauthorized access to the multi-tenant ConnectWise application to authenticate as the app itself, bypassing the need for interactive user logins. This allowed the attackers to sweep through customer environments with a speed and volume that traditional human-led operations rarely achieve.

The core of the operation involved the use of ARTEX, an open-source agentic AI penetration testing framework. Microsoft described the tool as a system of large language model-driven agents capable of executing autonomous penetration tests. By automating scanning, reconnaissance, and OAuth application abuse, the agents could operate continuously with minimal human input. This automation compressed the timeline for compromise significantly; in some instances, the group achieved privileged access to a tenant within three hours of initial targeting.

Beyond the primary application abuse, the attackers employed automated password spraying against 327 accounts across eight distinct organizations. This effort generated over 151,000 failed logon attempts without recording a single success. The pace was intense, peaking on October 11 with 2,900 attempts per minute, or more than 111,000 attempts for that day alone. While almost 98% of these specific actions resulted in account lockouts, the broader attack strategy relied on controlling the identities of multiple ConnectWise cloud apps to sign in from a shared IP range.

The operational tempo was striking. Using just four application credentials, the AI agents executed more than 200 sign-ins in under four minutes. Within affected tenants, the agents performed directory operations, reconnaissance, and modifications to app credentials, identities, and privileged roles. Huntress, a security firm monitoring the event, observed an app adding itself to the top administrator role in one tenant on October 15. By October 16, Huntress had confirmed unauthorized sign-ins for 162 tenants, a figure that grew to nearly 1,000 Entra tenants with sign-in activity from the attacking IP the following day, with over 300 succeeding.

Storm-0940 has been active since 2021 and has no known industry aliases. The group targeted 14 listed industries, including aerospace and defense, semiconductor, government, and think tanks. Microsoft clarified that the attack did not stem from a vulnerability in its own systems or products. The use of ARTEX represents a shift in tactics, as the framework can utilize various AI models. Public reporting has linked similar ARTEX-based breaches to South Korean financial institutions, with the suspect likely based in China. The framework’s developer, known as “Autumn-27,” announced that the project will transition to closed source and cease updates.

ConnectWise suspended several services, including Cloud Backup and SaaS Security, as a precautionary measure. A phased restoration is underway, with full recovery expected within several days. While there are no current indicators that partner backup data was compromised, Microsoft advises customers to keep affected app connections disabled and to review recent activity logs to assess their specific exposure.

The incident highlights the growing capability of AI-driven tools to accelerate the breach lifecycle. By moving from manual exploitation to autonomous, script-driven sweeps, attackers can test a massive number of potential victims in a matter of hours, leaving defenders with a narrow window to detect and respond before privileged access is secured.