Microsoft details AI-driven supply chain attack hitting 2,250 tenants

A sophisticated cyberattack leveraging autonomous artificial intelligence agents has compromised thousands of Microsoft 365 tenants through a vulnerability in the ConnectWise supply chain. The operation, attributed to a China-aligned threat actor known as Storm-0940, utilized ARTEX, an open-source framework that drives large language models to conduct penetration tests with minimal human oversight. This approach allowed the attackers to move with a speed that traditional manual methods rarely achieve, leaving defenders with a narrow window to detect and respond to the intrusion.

The scale of the intrusion is significant. The group attempted sign-ins at more than 2,250 different Microsoft 365 tenants using stolen credentials from ConnectWise applications. These stolen app credentials allowed the agents to authenticate without interactive user logins. In some instances, the attackers reached privileged access levels in less than three hours after initially targeting a specific organization. Additionally, automated password spraying campaigns targeted 327 accounts across eight organizations, resulting in over 151,000 failed login attempts with no successful breaches recorded in that specific vector.

Storm-0940 has been active since 2021 and is classified as a state-aligned actor with no known industry aliases. The recent campaign targeted 14 distinct industries, including aerospace and defense, semiconductors, government agencies, and think tanks. Microsoft clarified that the incident did not stem from a vulnerability in its own systems or products, but rather from unauthorized access to the third-party ConnectWise application. The precise method used to steal the initial ConnectWise credentials remains uncertain, as does the total number of tenants that were fully compromised.

At its peak on October 11, the password spraying activity reached 2,900 attempts per minute, totaling over 111,000 failures for the day. Nearly 98% of these attempts resulted in lockouts. However, the more insidious part of the attack involved AI agents using four specific application credentials to sign in to customer tenants from the same IP range. They executed more than 200 sign-ins in under four minutes. Once inside, the agents performed directory operations, changed app credentials, and modified privileged roles. In one specific case on October 15, a security firm observed an application adding itself to the top administrator role, a behavior that triggered specific alerts in Microsoft Defender.

The use of ARTEX distinguishes this attack from many traditional operations. The framework allows agents to work around the clock with little human interaction, accelerating scanning and reconnaissance. Public reporting this month linked similar technology to breaches at South Korean financial institutions, where the suspect allegedly used ARTEX with Anthropic’s Claude Code. In response to the growing threat, the developer of ARTEX announced that the project will no longer be updated and will transition to closed source. This shift may alter the landscape for both defenders and attackers who rely on open-source tools.

ConnectWise has suspended several services, including Cloud Backup and SaaS Security, as a precautionary measure. A phased restoration process has begun, with recovery expected to take several days. The company reports no indicators that partner backup data has been compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review activity logs from this month where possible. The incident highlights the increasing efficiency of AI-driven attacks and the complex challenges they pose to modern security defenses.

The rapid escalation of privileges and the volume of automated attempts suggest a highly organized effort. The attack’s pattern, including the sequential sweep through tenants, indicated a script working from a predefined target list. While the full impact on individual organizations remains under investigation, the use of autonomous agents marks a significant evolution in supply chain attacks. The involvement of a state-aligned actor and the potential for future closed-source developments in AI penetration testing tools underscore the need for continuous adaptation in cybersecurity strategies.