Storm-0940 Exploits AI Agents to Breach 2,250 Microsoft Tenants via ConnectWise

A high-speed cyber intrusion is testing the limits of modern defensive infrastructure as a China-state-aligned group known as Storm-0940 deploys artificial intelligence agents to automate a massive supply chain attack. By exploiting unauthorized access to the multi-tenant ConnectWise application, the threat actors attempted sign-ins at more than 2,250 Microsoft 365 tenants. The operation’s velocity is staggering; in some instances, the group secured privileged access to systems less than three hours after initial targeting, leaving security teams with minimal time to detect and respond.

The operation traces its roots to the adoption of ARTEX, an open-source agentic AI penetration testing framework. This system utilizes large language model-driven agents to conduct autonomous reconnaissance, scanning, and password spraying with little to no human interaction. The automated password guessing targeted 327 accounts across eight organizations, resulting in more than 151,000 failed logons. At its peak on Oct. 11, the spray executed 2,900 attempts per minute, with nearly 98% of the activity locked out, yet the use of stolen ConnectWise app credentials allowed the agents to authenticate without interactive user sign-in.

The campaign has significantly impacted critical sectors, including aerospace and defense, semiconductors, government, and think tanks, with 14 industries listed as targets. Microsoft confirmed that the activity did not stem from a vulnerability in its own systems but rather from the compromise of the third-party ConnectWise application. The group’s method involved signing into customer tenants from a specific IP range using the compromised app credentials, executing more than 200 sign-ins in under four minutes using just four application credentials.

Within the affected tenants, the AI agents performed Graph and directory operations, changed app credentials, and modified identities and privileged roles. On Oct. 15, security firm Huntress observed one app adding itself to the top administrator role, a behavior that triggered specific Microsoft Defender alerts. The firm confirmed unauthorized sign-ins for 162 tenants by Oct. 16 and nearly 1,000 Entra tenants by the following day, with over 300 sign-ins succeeding. The sequential nature of the attacks, occurring seconds apart in sorted order, indicated a script working from a pre-defined target list.

The use of ARTEX marks a shift from traditional attack methods, as the framework can integrate various AI models and is reportedly being used by actors in multiple regions. Public reports this month linked the technology to breaches at South Korean financial institutions, with suspects allegedly using Anthropic’s Claude Code. In response to the growing threat, the ARTEX developer, known by the handle Autumn-27, announced that the project would become closed source and would no longer be updated.

ConnectWise has suspended its Cloud Backup, SaaS Security, and Cloud Management services as a precautionary measure. A phased restoration process has begun, with recovery expected to take several days. While there are no current indicators that partner backup data was compromised, Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review activity logs from this month where available.

The incident underscores the growing speed and autonomy of AI-driven cyber threats. As defenders work to restore services and analyze the scope of the breach, the reliance on autonomous agents like ARTEX suggests a new era of rapid, high-volume supply chain attacks that may outpace traditional detection methods.