2,250 Tenants: The Scale of a New AI-Driven Supply Chain Breach

Microsoft has disclosed that a China-state-aligned threat actor, designated Storm-0940, utilized an open-source artificial intelligence framework to execute a massive supply chain attack against ConnectWise customers. According to the technology giant’s security blog, the group deployed ARTEX, an agentic AI penetration testing system, to automate reconnaissance and credential abuse. This approach allowed the attackers to interact with digital environments with minimal human oversight, accelerating the pace of the intrusion significantly.

The scale of the operation was extensive, with the threat group attempting sign-ins at more than 2,250 Microsoft 365 tenants. By leveraging stolen credentials from the ConnectWise application, the agents authenticated as the software itself rather than as individual users. The efficiency of this automated process was stark; in several instances, the attackers achieved privileged access within less than three hours of their initial targeting. Additionally, the group conducted automated password spraying campaigns that targeted 327 accounts across eight organizations, resulting in over 151,000 failed login attempts without a single success.

Storm-0940 has been active since 2021 and operates without known industry aliases, following naming conventions for developing actors. The organization targeted a diverse range of sectors, including aerospace and defense, the semiconductor industry, government entities, and think tanks, with fourteen specific industries listed in the report. Microsoft clarified that the incident did not stem from a vulnerability or compromise within its own systems, products, or services, but rather from the misuse of third-party application credentials.

At its peak on October 11, the password spraying activity reached 2,900 attempts per minute, all of which failed, with a daily total exceeding 111,000 attempts. Approximately 98 percent of this activity was locked out by security controls. However, the attackers’ control over multiple ConnectWise cloud app identities allowed them to sign in to customer tenants from the same IP range. In one notable instance, more than 200 sign-ins were executed in under four minutes using just four application credentials, demonstrating the rapid deployment capability of the AI agents.

Within compromised tenants, the attackers performed various operations, including directory modifications, reconnaissance, and changes to app credentials and privileged roles. On October 15, security firm Huntress observed an application in one tenant adding itself to the top administrator role, a behavior that triggered specific Microsoft Defender alerts. This action included the planting of new secrets configured to expire in 2028. By October 16, Huntress had confirmed unauthorized sign-ins for 162 tenants, and by the following day, nearly 1,000 Entra tenants showed sign-in activity from the attacking IP address, with more than 300 of those attempts succeeding.

The use of ARTEX distinguishes this campaign from traditional attacks, as the framework can utilize any AI model to run autonomous penetration tests. This technology has been linked to other breaches, including recent incidents at South Korean financial institutions, where CrowdStrike indicated a Chinese-based suspect likely used ARTEX with Anthropic’s Claude Code. In response to the widespread use of the tool, the developer of ARTEX, known by the handle “Autumn-27,” announced on GitHub that the project would become closed source and would no longer receive updates.

ConnectWise has acknowledged the unauthorized access and has taken precautionary steps by suspending its Cloud Backup, SaaS Security, and Cloud Management services. The company has initiated a phased restoration process, with full recovery expected to take several days, and currently has no indicators that partner backup data was compromised. Microsoft advises customers to maintain the suspension of affected app connections until formal restoration instructions are issued and to review recent activity logs where possible to assess potential exposure.

The incident highlights the evolving nature of cyber threats, where autonomous AI agents can operate around the clock with little human interaction. This speed leaves defenders with a narrow window to detect and respond to intrusions. As threat actors across multiple regions adopt these tools, the reliance on open-source AI frameworks for offensive operations is reshaping the landscape of enterprise security and supply chain risk management.