AI Agents Fuel Massive Breach of Microsoft 365 Tenants

Microsoft has confirmed that a sophisticated supply chain attack against ConnectWise was executed by Storm-0940, a threat group aligned with the Chinese state. The operation relied on ARTEX, an open-source framework that uses large language models to conduct autonomous penetration testing. This development marks a significant escalation in how attackers leverage artificial intelligence to breach corporate networks at scale.

The attackers exploited stolen credentials from ConnectWise applications to authenticate directly into over 2,250 Microsoft 365 tenants. By acting as the applications themselves, they bypassed interactive user sign-in processes. In some instances, the group achieved privileged access within three hours of initial targeting. Microsoft noted that the AI agents accelerated scanning, reconnaissance, and password spraying with minimal human intervention, leaving defenders with very little time to react.

Storm-0940 has been active since 2021 and targets sectors including aerospace, semiconductors, and government agencies. Microsoft clarified that the attack did not stem from vulnerabilities in its own infrastructure but rather from the compromised third-party app. The group also launched a parallel password-spraying campaign that generated over 151,000 failed logons across eight organizations. Although most attempts were blocked, the peak activity on October 11 reached 2,900 attempts per minute.

The identity takeover proved more effective than the brute-force efforts. Using four stolen application credentials, the AI agents recorded over 200 sign-ins in less than four minutes. They modified app roles, changed identities, and performed directory operations within the affected tenants. Security firm Huntress observed one tenant where an app assigned itself the Global Administrator role on October 15. By October 16, the firm had confirmed unauthorized sign-ins at 162 tenants, rising to nearly 1,000 by the following day.

The use of ARTEX distinguishes this campaign from traditional attacks, as the framework can work with various AI models. Public reporting this month linked similar tools to breaches at South Korean financial institutions. Meanwhile, the developer of ARTEX announced on GitHub that the project would become closed source and would no longer receive updates. This move may impact how other threat actors utilize the tool in future operations.

ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services as a precautionary measure. The company has begun a phased restoration process expected to take several days and reports no current indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review activity logs from this month to identify potential unauthorized access.