2,250 Tenants Targeted: AI-Driven Hackers Exploit Supply Chain Breach

Microsoft has disclosed that a China-state-aligned threat actor named Storm-0940 employed an open-source artificial intelligence framework to execute a large-scale supply chain attack through the multi-tenant application ConnectWise. The operation resulted in attempted sign-ins at more than 2,250 Microsoft 365 tenants, marking a significant escalation in the speed and automation of modern cyber intrusions.

The attackers leveraged stolen credentials from ConnectWise applications to authenticate without requiring interactive user sign-ins. This method allowed the AI agents to operate autonomously, significantly accelerating the processes of scanning, reconnaissance, and OAuth application abuse. The deployment of these agents enabled the group to maintain a continuous operational tempo with minimal human interaction, leaving defenders with compressed windows for detection and response.

In addition to the primary credential-based intrusions, the group conducted automated password spraying campaigns targeting 327 accounts across eight distinct organizations. This effort generated more than 151,000 failed logon attempts without achieving a single success. The use of the ARTEX framework, a system of LLM-driven agents designed for autonomous penetration testing, was central to this rapid execution, as noted in Microsoft’s security analysis.

The breadth of the attack was evident in its peak activity on October 11, when the password spray campaign reached 2,900 attempts per minute. On that single day, there were over 111,000 failed logins, with 48 individual accounts experiencing more than 1,000 failures each. Despite the high volume, nearly 98% of this activity resulted in lockouts, suggesting that while the automated guessing was intense, it was largely ineffective compared to the application credential abuse.

The most concerning aspect of the intrusion was the speed at which privileged access was obtained. In some instances, the attacking AI agents reached privileged access in less than three hours after initial targeting. By controlling the identities of multiple ConnectWise cloud apps, the agents signed into customer tenants from the same IP range, executing over 200 sign-ins in under four minutes using just four application credentials. Operations within these tenants included directory modifications, reconnaissance, and changes to privileged roles.

Security firm Huntress observed specific behaviors in one tenant on October 15, where an application added itself to the top administrator role, triggering a specific Microsoft Defender alert. The group also planted new secrets set to expire in 2028. By October 16, Huntress had confirmed unauthorized sign-ins for 162 tenants, and by the following day, nearly 1,000 Entra tenants showed sign-in activity from the attacking IP, with over 300 succeeding. The sequential nature of the sweep through tenants suggested a script working from a predefined target list.

Storm-0940 has been active since 2021 and is described as having no known industry aliases. The targeted industries included aerospace and defense, semiconductor, government, and think tanks, totaling 14 sectors. Microsoft clarified that the activity did not stem from a compromise or vulnerability in its own systems or products. The uncertainty remains regarding how the initial ConnectWise credentials were stolen and the exact number of tenants ultimately compromised.

ConnectWise responded by suspending Cloud Backup, SaaS Security, and Cloud Management as a precautionary measure. A phased restoration has begun, with recovery expected to take several days, and no indicators have yet suggested that partner backup data was compromised. Meanwhile, the developer of the ARTEX framework, known as Autumn-27, stated that the project will no longer be updated and will become closed source, following public reports linking the tool to other breaches in the region.

Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review activity logs from this month where possible. The incident highlights the growing threat of AI-assisted attacks, which can operate at a pace that challenges traditional defensive strategies, particularly when leveraging open-source tools that can be adapted by threat actors in multiple regions.