Microsoft details AI-driven supply chain breach impacting 2,250 tenants
China-aligned hackers leveraged autonomous AI agents to probe thousands of Microsoft 365 environments, with some privileged access achieved in under three hours.
By James Brooks ·
Microsoft has disclosed that a China-aligned threat group utilized an open-source artificial intelligence framework to execute a broad supply chain attack against ConnectWise. The operation resulted in attempted sign-ins across more than 2,250 Microsoft 365 tenants. By exploiting stolen application credentials, the attackers bypassed interactive user authentication, allowing them to scan and probe environments at a speed that significantly compressed the window for defensive response.
The primary actor, identified as Storm-0940, has been active since 2021 and is currently operating without a known industry alias. According to Microsoft’s security blog, the group employed ARTEX, a system of large language model-driven agents designed for autonomous penetration testing. This technology accelerated reconnaissance, OAuth application abuse, and password spraying. The AI agents operated continuously with minimal human intervention, a pace that left defenders with limited time to detect anomalies and deploy countermeasures.
The financial and operational impact of the intrusion is substantial. At its peak on October 11, the automated password spraying campaign generated 2,900 failed attempts per minute, totaling over 111,000 failures for that day alone. While nearly 98% of these accounts were locked out, the attackers maintained control over multiple ConnectWise cloud application identities. This allowed the AI agents to sign into customer tenants from a single IP range, executing over 200 sign-ins in under four minutes using just four distinct application credentials.
Once inside, the group performed a series of high-value operations, including Graph and directory modifications, credential changes, and adjustments to privileged roles. In one instance on October 15, security firm Huntress observed an application assigning itself to the top administrator role, a behavior that triggered a specific Microsoft Defender alert. The attackers also planted new secrets configured to expire in 2028. By October 16, unauthorized sign-ins were confirmed in 162 tenants, and the following day, nearly 1,000 Entra tenants showed sign-in activity from the attacking IP, with more than 300 of those attempts succeeding.
The targeting strategy focused on high-value sectors, including aerospace and defense, semiconductors, government, and think tanks. Microsoft clarified that the attack did not stem from a vulnerability in its own systems or products, but rather from the compromise of the ConnectWise multi-tenant application. The sweep through tenants in sorted order, occurring seconds apart, indicated the use of a script working from a predefined target list. It remains uncertain how the initial ConnectWise credentials were stolen or the precise number of tenants that suffered data compromise.
ConnectWise has responded to the incident by suspending its Cloud Backup, SaaS Security, and Cloud Management services as a precautionary measure. The company has initiated a phased restoration process, with recovery expected to take several days. To date, ConnectWise has not found indicators that partner backup data was compromised. Microsoft advises customers to keep affected application connections disabled until formal restoration instructions are issued and to review activity logs from this month where possible.
The incident highlights a shift in threat landscape tactics, as the use of ARTEX is not unique to this group. Public reporting this month linked the same framework to breaches at South Korean financial institutions, with CrowdStrike noting the suspect was likely based in China and used the tool alongside Anthropic’s Claude Code. In response to the widespread adoption by threat actors, the developer of ARTEX, known by the handle 'Autumn-27', announced on GitHub that the project will no longer be updated and will transition to a closed-source model.
This event underscores the increasing efficiency of AI-assisted cyber operations. By automating complex penetration testing tasks, the attackers reduced the time-to-compromise for privileged access to under three hours in several cases. For the Mid-Atlantic business community, particularly those in the targeted industrial and government sectors, the incident serves as a reminder that third-party software vendors represent a critical point of failure in the supply chain, requiring vigilant monitoring of application sign-ins and role changes.
