Microsoft Attributes 2,250-Tenant Breach to China-Aligned Group Using AI Tools

Microsoft identified Storm-0940 as the threat actor behind a supply chain intrusion affecting more than 2,250 Microsoft 365 tenants. The company stated that the group exploited an open-source agentic AI framework named ARTEX to gain unauthorized entry into a multi-tenant ConnectWise application. According to Microsoft's security blog, the attackers used stolen credentials to authenticate as the applications themselves, bypassing interactive user sign-ins. In several cases, the intrusions reached privileged access levels in under three hours after the initial targeting began.

The operation relied on LLM-driven agents that performed autonomous penetration testing. Microsoft described ARTEX as a system that accelerated scanning, reconnaissance, and password spraying. These agents operated continuously with minimal human oversight, reducing the time available for defenders to detect and respond to the activity. The campaign targeted 14 industries, with aerospace and defense, semiconductors, government, and think tanks listed among the primary sectors. Microsoft clarified that the attack did not originate from a vulnerability in its own systems or services.

A separate password-spraying campaign targeted 327 accounts across eight organizations. This effort generated more than 151,000 failed logons, with no successful logins recorded. On October 11, the spray reached a peak of 2,900 attempts per minute. Nearly 98% of the activity resulted in account lockouts, with 48 accounts each exceeding 1,000 failed attempts. The high volume of failures indicated a systematic approach to testing weak credentials across the targeted entities.

The identity takeover of ConnectWise cloud applications proved more effective than the password spray. Using four application credentials, the AI agents recorded more than 200 sign-ins in under four minutes from the same IP range. Within affected tenants, the actors performed Graph and directory operations, changed app credentials, and modified privileged roles. Huntress, a security firm, observed one tenant on October 15 where an application added itself to the Global Administrator role. This action triggered a Microsoft Defender alert indicating that an application had self-assigned a global administrator role.

By October 16, Huntress confirmed unauthorized sign-ins at 162 tenants. The following day, the firm counted nearly 1,000 Entra tenants with sign-in activity from the attacking IP address, with more than 300 of those sign-ins being successful. The attackers moved through tenants in sorted order, with intervals of seconds between actions. Huntress noted this pattern suggested a script working from a predefined target list. The use of ARTEX, which can integrate with various AI models, distinguished this campaign from traditional attacks. Public reports this month linked the framework to breaches at South Korean financial institutions, where the suspect allegedly used it with Anthropic's Claude Code.

ConnectWise detected the unauthorized access and suspended its Cloud Backup, SaaS Security, and Cloud Management services as a precaution. The company has begun a phased restoration process expected to take several days. It reported no indicators that partner backup data was compromised. Microsoft advised customers to keep affected app connections disabled until formal restoration instructions are issued. The company also recommended that customers review activity logs from the current month to identify any unusual behavior.

The developer of ARTEX, known by the handle Autumn-27, announced on GitHub that the project would no longer be updated and would become closed source. This change follows reports linking the tool to multiple high-profile breaches. Microsoft cautioned that an affected app or successful sign-in does not necessarily mean data was accessed or exfiltrated. The incident highlights the growing capability of AI-driven agents to automate complex intrusion steps at scale.