2,250: Microsoft 365 Tenants Targeted in AI-Driven Supply Chain Breach

More than 2,250 Microsoft 365 tenants were targeted in a sophisticated supply chain attack that leveraged autonomous artificial intelligence agents to accelerate reconnaissance and intrusion efforts. The campaign, attributed to a China-state-aligned actor known as Storm-0940, exploited unauthorized access to the multi-tenant application ConnectWise. By using stolen credentials associated with ConnectWise applications, the attackers authenticated without interactive user sign-ins, allowing them to sweep through customer environments at a speed that traditional defense mechanisms struggle to match.

The operation relied heavily on ARTEX, an open-source agentic AI penetration testing framework. This system employs large language model-driven agents to conduct autonomous testing, significantly speeding up processes such as scanning, password spraying, and OAuth application abuse. According to Microsoft, these agents operate with little need for human interaction, maintaining a relentless pace that leaves defenders with limited time to detect and respond to the intrusion.

Peak activity occurred on Oct. 11, when the password spraying campaign reached approximately 2,900 failed attempts per minute, totaling over 111,000 failures for the day. While nearly 98% of these attempts resulted in lockouts, the attackers also successfully utilized four application credentials to achieve more than 200 sign-ins in under four minutes from the same IP range. In some targeted tenants, the attackers gained privileged access less than three hours after initial targeting, performing directory operations, changing app credentials, and modifying identities and groups.

The attack focused on specific high-value sectors, including aerospace and defense, semiconductor manufacturing, government agencies, and think tanks. Microsoft confirmed that the activity did not stem from a vulnerability in its own systems or products. Instead, the breach originated from the compromise of ConnectWise cloud applications. Huntress, a security firm, observed one tenant where an application self-assigned to the top administrator role on Oct. 15, a behavior that triggered specific alerts in Microsoft Defender. By Oct. 16, unauthorized sign-ins were confirmed for 162 tenants, rising to nearly 1,000 tenants with activity from the attacking IP by the following day, with more than 300 successful logins.

ConnectWise has suspended its Cloud Backup, SaaS Security, and Cloud Management services as a precautionary measure. A phased restoration process has begun, with full recovery expected to take several days. The company has not yet found indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review activity logs from this month where possible.

The use of ARTEX marks a shift in attack methodology, as the framework can utilize various AI models. Public reporting this month has linked similar breaches at South Korean financial institutions to the use of ARTEX, with the suspect allegedly using Anthropic’s Claude Code. The developer of ARTEX, identified by the handle Autumn-27, announced on GitHub that the project would become closed source and would no longer be updated, a move reported by Reuters.

It remains uncertain exactly how the ConnectWise credentials were initially stolen or the precise number of tenants that suffered data access. However, the systematic, sorted-order sweep of tenants suggests a scripted approach working from a predefined target list. This incident highlights the growing threat posed by AI-driven agents that can execute complex penetration tests autonomously, compressing the timeline for compromise from days to hours.