2,250 Tenants: The Scale of the AI-Driven Supply Chain Breach

Microsoft has detailed how a China-state-aligned group known as Storm-0940 utilized autonomous AI agents to execute a sweeping supply chain attack via the ConnectWise platform. The operation, which peaked in activity in mid-October, saw the threat actor deploy ARTEX, an open-source agentic framework, to automate the most labor-intensive phases of a penetration test. By leveraging large language model-driven agents, the group was able to conduct reconnaissance, scanning, and credential abuse at a speed that traditional human-led attacks rarely achieve, leaving defenders with minimal time to react.

The scale of the intrusion is defined by the sheer volume of attempted access points. The attackers attempted sign-ins across more than 2,250 distinct Microsoft 365 tenants. Using stolen credentials from ConnectWise applications, the AI agents authenticated as the software itself, bypassing the need for interactive user logins. This method allowed the system to move through environments seamlessly, with some of the group’s operations reaching privileged access levels in less than three hours after initial targeting.

Parallel to the application-based access, the group executed an aggressive password spraying campaign. This automated guessing attempt targeted 327 accounts across eight different organizations. The volume of traffic was immense, resulting in more than 151,000 failed logon attempts, though none were successful. At its peak on October 11, the password spray generated 2,900 failed attempts per minute, totaling over 111,000 failures for that single day. Nearly 98% of these activities resulted in account lockouts, indicating the automated nature of the brute-force approach.

Storm-0940, active since 2021, is a developing actor with no known industry aliases. The group targeted 14 specific industries, including aerospace and defense, semiconductors, government entities, and think tanks. Microsoft clarified that the attack did not stem from a vulnerability in its own systems or products, but rather from the compromise of the multi-tenant ConnectWise application. The AI agents operated continuously with little human interaction, using four application credentials to generate more than 200 sign-ins in under four minutes from the same IP range.

Security firm Huntress provided critical insights into the behavior observed in the wild. On October 15, analysts at Huntress observed an application adding itself to the top administrator role in one tenant, a specific behavior that triggered Microsoft Defender alerts. The group also planted new secrets with expiration dates set for 2028. By October 16, Huntress had confirmed unauthorized sign-ins for 162 tenants. The following day, the number of Entra tenants showing sign-in activity from the attacking IP jumped to nearly 1,000, with more than 300 of those sign-ins succeeding. The sequential, sorted nature of the tenant sweep suggested the use of a script working from a pre-defined target list.

The use of ARTEX represents a shift in threat actor methodology. Developed by a user known as “Autumn-27,” the framework allows for autonomous penetration testing using various AI models. Public reports have linked similar AI-driven breaches to South Korean financial institutions, where the suspect allegedly used ARTEX with Anthropic’s Claude Code. In response to the growing adoption of the tool by threat actors, the developer announced on GitHub that the project would cease updates and transition to closed source.

ConnectWise responded by suspending its Cloud Backup, SaaS Security, and Cloud Management services as a precautionary measure. The company has begun a phased restoration process, with recovery expected to take several days. To date, there are no indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review activity logs from this month where possible.

The stakes of this incident highlight the accelerating pace of AI-assisted cyber operations. The ability of agents to work around the clock and navigate complex cloud environments in minutes rather than days compresses the detection window for defenders. As threat actors in multiple regions adopt these tools, the traditional rhythm of incident response may need to shift to match the autonomous speed of the attack.