2,250 Tenants: China-Aligned Hackers Use AI Agents to Sweep Microsoft 365

More than 2,250 Microsoft 365 tenants were targeted by automated sign-in attempts following a supply chain attack on ConnectWise, a multi-tenant application platform. The operation, conducted by a China-state-aligned group known as Storm-0940, utilized stolen application credentials to authenticate into customer environments without interactive user logins. Microsoft Security identified this campaign in a recent blog post, highlighting the speed and scale of the intrusion that swept through the compromised software ecosystem.

The attack relied on ARTEX, an open-source agentic AI penetration testing framework, which allowed the threat actors to execute autonomous reconnaissance, password spraying, and OAuth application abuse. According to Microsoft, these LLM-driven agents operated continuously with minimal human interaction, a pace that significantly reduced the time defenders had to detect and respond to the intrusion. In some instances, the group achieved privileged access within three hours of initial targeting, demonstrating the accelerated timeline enabled by the AI tools.

The campaign, active since 2021 and previously unidentified by industry aliases, focused on critical sectors including aerospace, defense, semiconductor, government, and think tanks. A total of 14 industries were listed as targets. Microsoft clarified that the activity did not stem from vulnerabilities in its own systems or products, but rather from the unauthorized access to the ConnectWise application. The group’s use of automated password guessing resulted in over 151,000 failed logons across 327 accounts in eight organizations, with no successful guesses recorded in that specific vector.

At its peak on October 11, the password spraying activity reached 2,900 attempts per minute, totaling over 111,000 failures for the day. Despite nearly 98% of these accounts being locked out, the attackers leveraged the compromised ConnectWise credentials to sign in from a specific IP range. In one rapid burst, more than 200 sign-ins were executed in under four minutes using just four application credentials. These sessions included Graph and directory operations, reconnaissance, and changes to identities and privileged roles.

Huntress, a security firm, observed specific behaviors in one tenant on October 15, where an application added itself to the top administrator role. This action triggered Microsoft Defender alerts for applications self-assigning Global Administrator roles. The group also planted new secrets set to expire in 2028. By October 16, Huntress confirmed unauthorized sign-ins for 162 tenants, and by the following day, nearly 1,000 tenants showed activity from the attacking IP, with over 300 successful logins. The sequential nature of the sweep, occurring seconds apart, indicated a script operating from a pre-defined target list.

ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services as a precautionary measure. The company has begun a phased restoration process, with recovery expected to take several days, and has reported no indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review recent activity logs. The use of ARTEX, which can run on any AI model, marks a shift in threat actor tactics, with similar tools recently linked to breaches in South Korean financial institutions.

The developer of ARTEX, known by the handle Autumn-27, announced on GitHub that the project would stop being updated and transition to closed source. CrowdStrike noted that the suspect in related attacks was likely based in China and allegedly used ARTEX with Anthropic’s Claude Code. This incident underscores the growing integration of autonomous AI in cyber operations, forcing organizations to adapt their detection strategies to counter agents that operate at machine speed.