Storm-0940 Harnesses AI Agents to Breach 2,250 Microsoft Tenants

More than 2,250 Microsoft 365 tenants faced attempted sign-ins from a sophisticated supply chain attack that utilized artificial intelligence to accelerate the intrusion. This figure represents the scale of the automated sweep conducted by a group known as Storm-0940, which leveraged stolen credentials from ConnectWise to authenticate as applications rather than individual users. The operation highlights a shift in cyberattack methodology where machine-driven agents perform reconnaissance and exploitation with a speed that traditional human-led teams often struggle to match. The incident, detailed in a recent Microsoft security blog, underscores the growing reliance on open-source AI frameworks in state-sponsored hacking campaigns.

The numbers reveal a relentless and automated campaign that peaked on October 11. During that single day, the attackers generated over 111,000 failed logon attempts, with a peak rate of 2,900 attempts per minute. These actions were part of a broader password spraying effort that targeted 327 accounts across eight organizations, resulting in more than 151,000 failed logons without any successful breaches through that specific method. While 98 percent of these automated guesses were locked out, the attackers did not stop there. They pivoted to using stolen ConnectWise application credentials, which allowed them to sign in without interactive user prompts. In one rapid sequence, more than 200 sign-ins were executed in under four minutes using just four application credentials.

The primary actor behind this disruption is Storm-0940, a group Microsoft describes as a China-state aligned entity that has been active since 2021. The group does not have known industry aliases, and its naming convention suggests it is a developing threat actor. The targets of this specific campaign were carefully selected, including 14 entities from the aerospace and defense, semiconductor, government, and think tank sectors. Microsoft clarified that the attack did not stem from a vulnerability in their own systems or products, but rather from unauthorized access to the multi-tenant ConnectWise application. This distinction places the initial breach vector outside of Microsoft’s direct infrastructure, pointing to a third-party supply chain compromise.

The technology driving the attack was ARTEX, an open-source agentic AI penetration testing framework. Microsoft noted that ARTEX utilizes a system of large language model driven agents that run autonomous penetration tests. These agents can operate around the clock with minimal human interaction, significantly speeding up scanning, reconnaissance, and OAuth application abuse. The efficiency of this tool left defenders with little time to detect and respond to the intrusion. The use of such open-source tools is not isolated to this group; public reporting this month has linked similar technology to breaches at South Korean financial institutions. In those separate cases, the suspect was likely based in China and allegedly used ARTEX with Anthropic’s Claude Code.

The speed of the compromise was alarming to security researchers. Some of the group’s attacks reached privileged access in less than three hours after initial targeting. In one specific tenant, a security firm named Huntress observed an application adding itself to the top administrator role on October 15. This behavior triggered a Microsoft Defender alert for application self-assignment of the Global Administrator role. The attackers also planted new secrets set to expire in 2028, indicating a long-term persistence strategy. By October 16, Huntress confirmed unauthorized sign-ins for 162 tenants. The following day, the count rose to nearly 1,000 Entra tenants with sign-in activity from the attacking IP, with more than 300 of those sign-ins succeeding.

The pattern of the attack suggested a highly organized, script-driven approach. The sweep through tenants occurred in sorted order, with actions separated by only a few seconds. This cadence indicated that a script was working from a predefined target list, rather than the attackers manually probing each system. Operations within the compromised tenants included Graph and directory operations, reconnaissance, and changes to application credentials. The attackers also modified identities, groups, and privileged roles, solidifying their control over the compromised environments. The use of the same IP range for sign-ins across multiple customers further linked the disparate intrusions to a single coordinated source.

In response to the threat, ARTEX’s developer, who operates under the handle Autumn-27, announced on GitHub that the project will no longer be updated. The codebase is set to become closed source, a move that may limit the immediate availability of the tool to other threat actors. Reuters reported on this development, noting the significance of a widely used open-source framework shifting to a closed model in the midst of high-profile attacks. This change could alter how other groups approach automated penetration testing, potentially forcing them to build custom solutions or seek alternative frameworks. The closure of ARTEX also adds a layer of uncertainty for defenders who may be tracking the tool’s specific signatures and behaviors.

ConnectWise has taken immediate action to mitigate the impact of the breach. The company noted the unauthorized access and suspended its Cloud Backup, formerly known as SkyKick, as well as its SaaS Security and Cloud Management services as a precaution. A phased restoration process has begun, with full recovery expected to take several days. To date, ConnectWise has no indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued. The company also recommends that organizations review activity from this month where logs allow, noting that an affected app or successful sign-in does not necessarily mean data was accessed or taken.

The stakes for the targeted industries are high, given the sensitive nature of the sectors involved. Aerospace, defense, semiconductor, and government entities face potential risks from the changes made to privileged roles and the planting of long-term secrets. The attack’s reliance on AI agents suggests a new era of rapid, automated supply chain compromises that traditional detection methods may miss. As defenders grapple with the speed of these AI-driven intrusions, the incident serves as a clear warning about the vulnerabilities inherent in multi-tenant cloud applications. The coming days will likely bring more detailed analyses of the specific data accessed, if any, and the long-term implications for the targeted organizations.

The incident also highlights the broader trend of threat actors in multiple regions adopting AI-driven tools for cyber operations. The use of ARTEX in this attack and in breaches at South Korean financial institutions points to a widespread adoption of these technologies. The ability of these agents to work around the clock with little human interaction changes the calculus for defenders, who must now contend with attacks that do not follow traditional human schedules or patterns. As the restoration of ConnectWise services progresses, the industry will be watching closely for any additional signs of compromise and for the potential emergence of new AI-driven attack frameworks that could fill the void left by ARTEX’s shift to closed source.