Storm-0940 leverages AI agents to breach 2,250 Microsoft 365 tenants via ConnectWise

China-state-aligned cyber actors known as Storm-0940 executed a large-scale supply chain attack by deploying artificial intelligence agents through the open-source framework ARTEX. According to Microsoft, the group exploited unauthorized access to the multi-tenant ConnectWise application to launch a coordinated offensive against enterprise environments. The operation resulted in attempted sign-ins across more than 2,250 Microsoft 365 tenants, marking a significant escalation in the use of automated tools for intrusion.

The attackers utilized stolen credentials from ConnectWise applications to authenticate as the software itself, bypassing the need for interactive user sign-ins. This method allowed the AI-driven agents to move rapidly through corporate networks. In several instances, the group secured privileged access to tenant environments less than three hours after initially targeting them, a speed that Microsoft says leaves defenders with minimal time to detect and respond.

Storm-0940, an actor active since 2021 with no known industry aliases, targeted a diverse range of sectors. The list of affected industries includes aerospace and defense, semiconductor manufacturing, government entities, and think tanks, totaling fourteen distinct sectors. Microsoft clarified that the breach did not stem from a vulnerability in its own systems or products, but rather from the compromise of the third-party ConnectWise application.

In addition to the primary credential abuse, the group conducted extensive password spraying campaigns. These automated guessing attempts targeted 327 accounts across eight organizations, generating over 151,000 failed logon attempts without any successful breaches. The peak of this activity occurred on October 11, when the system recorded 2,900 failed attempts per minute. For that single day, the total exceeded 111,000 attempts, with 48 specific accounts suffering more than 1,000 failures each, although nearly 98% of the activity was eventually locked out.

The use of ARTEX, described as a system of large language model-driven agents, significantly accelerated the reconnaissance and scanning phases of the attack. These agents operated autonomously with little human intervention, allowing for continuous activity. In one specific tenant on October 15, security firm Huntress observed an application adding itself to the top administrator role, a behavior that triggered alerts in Microsoft Defender. The attackers also planted new secrets configured to expire in 2028, indicating a long-term persistence strategy.

By October 16, Huntress had confirmed unauthorized sign-ins for 162 tenants. The following day, that number jumped to almost 1,000 Entra tenants exhibiting sign-in activity from the attacking IP, with over 300 of those sign-ins succeeding. The pattern of the attack, which swept through tenants in sorted order at intervals of just a few seconds, suggested the use of a script working from a predefined target list. The agents performed various operations, including directory changes, identity modifications, and adjustments to privileged roles.

This incident highlights a shift in threat actor tactics, particularly the adoption of ARTEX, which can utilize various AI models. Recent reporting has linked the framework to breaches at South Korean financial institutions, where the suspect was allegedly based in China and used Anthropic’s Claude Code. The developer of ARTEX, identified by the handle Autumn-27, announced on GitHub that the project would become closed source and cease updates, a move that may impact how other groups utilize the tool.

ConnectWise has responded to the unauthorized access by suspending its Cloud Backup, SaaS Security, and Cloud Management services as a precautionary measure. A phased restoration process has begun, with full recovery expected to take several days. The company has reported no indicators to date that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review recent activity logs where possible, noting that a successful sign-in does not automatically confirm data exfiltration.