Storm-0940 Leverages AI Agents to Breach 2,250 Microsoft Tenants via ConnectWise

More than 2,250 Microsoft 365 tenants were targeted in a widespread supply chain attack that leveraged artificial intelligence to accelerate the intrusion process. The campaign, attributed to a China-state-aligned group known as Storm-0940, utilized stolen credentials from the ConnectWise platform to authenticate as applications rather than individual users. This method allowed the attackers to bypass standard interactive sign-in protocols, enabling them to sweep through customer environments with significant speed and efficiency.

Microsoft detailed the operation in a recent security blog post, noting that the group employed ARTEX, an open-source agentic AI penetration testing framework. By utilizing a system of large language model-driven agents, the attackers automated scanning, reconnaissance, and password spraying. Microsoft described the technology as capable of running autonomous tests with minimal human interaction, a pace that leaves defenders with limited time to detect and respond to the intrusion.

The velocity of the attack was striking. In some cases, the group achieved privileged access to a tenant in less than three hours after initial targeting. On October 11, the peak of the campaign saw a password spraying operation generate 2,900 failed attempts per minute, totaling over 111,000 failures for that day. While nearly 98% of these accounts were locked out, the group’s control over multiple ConnectWise cloud application identities allowed them to sign in to customer tenants from the same IP range. In one instance, more than 200 sign-ins were executed in under four minutes using just four application credentials.

Storm-0940, active since 2021 and previously without known industry aliases, targeted 14 organizations across sectors including aerospace and defense, semiconductors, government, and think tanks. The activity did not stem from a vulnerability in Microsoft’s own systems but rather from the compromise of the multi-tenant ConnectWise application. Within affected tenants, the AI agents performed Graph and directory operations, changed application credentials, and modified identities, groups, and privileged roles.

Security firm Huntress observed specific malicious behavior on October 15, where an application added itself to the top administrator role. This action triggered a Microsoft Defender alert regarding an application self-assigning a Global Administrator role. The attackers also planted new secrets configured to expire in 2028. By October 16, Huntress had confirmed unauthorized sign-ins for 162 tenants, a figure that rose to almost 1,000 Entra tenants with sign-in activity from the attacking IP by the following day, with more than 300 of those sign-ins succeeding.

The use of ARTEX distinguishes this campaign from many traditional attacks, as the framework can utilize any AI model. Public reporting this month has linked the technology to breaches at South Korean financial institutions, with CrowdStrike suggesting the suspect in those cases was likely based in China and used ARTEX with Anthropic’s Claude Code. In response to the growing use of the tool, ARTEX’s developer, known by the handle “Autumn-27,” announced on GitHub that the project would become closed source and would no longer receive updates.

ConnectWise has suspended its Cloud Backup, SaaS Security, and Cloud Management services as a precaution and has begun a phased restoration process. The company expects recovery to take several days and currently has no indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review activity logs from this month where available, noting that a successful sign-in does not necessarily confirm that data was accessed or exfiltrated.