Microsoft details how Storm-0940 leveraged AI agents to breach 2,250 tenants

Microsoft has revealed that a hacking group aligned with China utilized an artificial intelligence framework to execute a widespread attack on the ConnectWise platform. The actor, identified as Storm-0940, leveraged a tool called ARTEX to automate the penetration testing process. This approach allowed the group to attempt sign-ins across more than 2,250 different Microsoft 365 tenants. By using stolen credentials from the multi-tenant application, the hackers could authenticate without requiring interactive user logins. In several instances, the attackers achieved privileged access in less than three hours after initially targeting a specific organization.

The incident highlights a significant shift in how threat actors conduct operations. Traditionally, such campaigns required extensive manual effort. However, the integration of large language model driven agents changed the pace. These AI agents could perform scanning, reconnaissance, and password spraying with minimal human input. They worked around the clock, a speed that left defenders with very little time to detect anomalies. The use of this technology also enabled the group to efficiently abuse OAuth applications and guess passwords across multiple accounts.

The timeline of the intrusion began with the unauthorized access to the ConnectWise application. Once inside, the group conducted password spraying against 327 accounts within eight distinct organizations. This activity resulted in over 151,000 failed logon attempts, although no successful logins were recorded during that specific phase. The attack peaked on October 11, when the password spray generated 2,900 attempts per minute. That day alone saw more than 111,000 total attempts. While nearly 98 percent of these activities resulted in account lockouts, the automated nature of the attack allowed for sustained pressure on the systems.

Storm-0940 has been active since 2021 and does not have known industry aliases. The group targeted fourteen industries in total, including aerospace and defense, semiconductor manufacturing, government entities, and think tanks. Microsoft clarified that the breach did not stem from a vulnerability in its own systems or products. Instead, the entry point was the compromised ConnectWise application. The attackers used the identities of multiple ConnectWise cloud apps to sign in to customer tenants from the same IP range. Using just four application credentials, they managed to execute more than 200 sign-ins in under four minutes.

Within the compromised tenants, the AI agents performed various operations. These included Graph and directory operations, further reconnaissance, and changes to application credentials. They also modified identities, groups, and privileged roles. On October 15, a security firm named Huntress observed an application adding itself to the top administrator role in one tenant. This action triggered a specific alert in Microsoft Defender regarding self-assigned Global Administrator roles. The attackers also planted new secrets configured to expire in 2028. By October 16, Huntress confirmed unauthorized sign-ins for 162 tenants. A day later, that number rose to almost 1,000 tenants with sign-in activity from the attacking IP, with more than 300 sign-ins succeeding.

The methodical nature of the sweep through tenants suggested a script working from a pre-defined target list. Sign-ins occurred in sorted order, separated by only a few seconds. This pattern is distinct from many traditional attacks due to the reliance on the open-source pentest framework. Microsoft noted that ARTEX can utilize any AI model, and threat actors in multiple regions are now using this technology. Recent public reports linked similar breaches at South Korean financial institutions to this group. CrowdStrike suggested the suspect was likely based in China and used ARTEX with Anthropic’s Claude Code.

The developer of ARTEX, known by the handle Autumn-27, announced on GitHub that the project would no longer be updated. The tool is set to become closed source, according to Reuters reporting. In response to the incident, ConnectWise noted the unauthorized access and suspended several services as a precaution. These included Cloud Backup, formerly known as SkyKick, along with SaaS Security and Cloud Management. The company has begun a phased restoration process, with recovery expected to take several days. So far, there are no indicators that partner backup data was compromised.

Microsoft advises customers that an affected app or a successful sign-in does not automatically mean data was accessed or taken. Organizations are urged to keep affected app connections disabled until formal restoration instructions are issued. Companies should also review activity logs from this month where possible to identify any suspicious behavior. The event underscores the growing impact of AI-driven automation in supply chain attacks. As these tools become more accessible, the window for detection and response continues to shrink. Defenders must now account for high-speed, autonomous operations that can traverse hundreds of tenants in a matter of hours.