2,250 Microsoft Tenants Targeted as AI-Driven Hackers Breach Supply Chain

The intersection of artificial intelligence and cyber warfare has reached a critical threshold, as evidenced by a massive supply chain attack that swept through enterprise networks this month.

Microsoft identified the China-state-aligned group Storm-0940 as the architect of this operation, which utilized ARTEX, an open-source agentic framework. This tool employs large language model agents to conduct autonomous penetration tests, significantly accelerating the pace of reconnaissance and credential abuse. The primary vector involved stolen credentials from the multi-tenant application ConnectWise, which allowed the attackers to authenticate as applications without requiring interactive user sign-ins.

The scale of the intrusion was extensive, with the group attempting sign-ins at more than 2,250 Microsoft 365 tenants. Simultaneously, automated password spraying campaigns targeted 327 accounts across eight organizations, generating over 151,000 failed logons. While nearly 98% of these spray attempts were locked out, the use of app credentials proved far more effective. In some instances, the AI agents reached privileged access levels in less than three hours after initial targeting. At its peak on October 11, the password spray campaign executed 2,900 attempts per minute, with 48 specific accounts suffering more than 1,000 failures each.

The operational efficiency of the AI agents allowed them to sign into customer tenants from the same IP range using just four application credentials. In a notable burst, more than 200 sign-ins were recorded in under four minutes. Within compromised tenants, the agents performed directory operations, changed app credentials, and modified privileged roles. On October 15, security firm Huntress observed an application assigning itself to the top administrator role, a behavior that triggered specific Microsoft Defender alerts. By October 17, Huntress had confirmed unauthorized sign-ins for nearly 1,000 tenants, with over 300 of those sign-ins succeeding.

The attack targeted high-value sectors including aerospace and defense, semiconductors, government, and think tanks. Microsoft clarified that the breach did not stem from a vulnerability in its own products but rather from the compromise of the third-party application. The use of ARTEX, which can be paired with various AI models, has been linked to other recent breaches, including incidents at South Korean financial institutions where the suspect allegedly used the framework with Anthropic’s Claude Code. The developer of ARTEX has since announced the project will become closed-source and cease updates.

ConnectWise responded by suspending its Cloud Backup, SaaS Security, and Cloud Management services as a precautionary measure. A phased restoration process has begun, with full recovery expected to take several days. While no indicators suggest partner backup data was compromised, Microsoft advises customers to keep affected app connections disabled and review activity logs from this month. The incident highlights the growing market risk posed by autonomous tools that can operate with minimal human interaction, leaving defenders with limited time to react.