2,250 Tenants Hit by AI-Driven Supply Chain Breach

Microsoft has confirmed that a China-state-aligned hacking group attempted sign-ins at more than 2,250 Microsoft 365 tenants using stolen credentials from the ConnectWise multi-tenant application. The operation, attributed to the actor known as Storm-0940, represents a significant escalation in supply chain attacks, with some intrusions achieving privileged access in under three hours. This rapid timeline highlights the efficiency of the automated tools employed in the campaign.

The attackers utilized ARTEX, an open-source agentic AI penetration testing framework, to automate scanning, reconnaissance, and password spraying. By leveraging large language model-driven agents that operate with minimal human interaction, the group executed OAuth application abuse at a pace that left defenders with limited time to react. The use of these autonomous agents allowed the threat actor to maintain a relentless offensive posture, significantly compressing the window between initial access and lateral movement.

In addition to the application-based sign-ins, the campaign included aggressive password spraying targeting 327 accounts across eight organizations. This effort resulted in more than 151,000 failed logon attempts with no successful breaches. At its peak on October 11, the password spray registered 2,900 attempts per minute, with 48 specific accounts experiencing over 1,000 failures each. Almost 98% of this activity was locked out, but the volume of attempts demonstrated the scale of the automated effort.

The primary vector of compromise was the unauthorized use of ConnectWise cloud application credentials. The AI agents used these credentials to sign in to customer tenants from the same IP range, executing over 200 sign-ins in under four minutes using just four application identities. Within these tenants, the attackers performed directory operations, changed app credentials, and modified privileged roles. The systematic, sorted-order sweep of tenants suggested the use of a script working from a predefined target list.

Security firm Huntress identified specific malicious behaviors, including an application adding itself to the top administrator role in one tenant on October 15. The group also planted new secrets set to expire in 2028. By October 16, Huntress had confirmed unauthorized sign-ins for 162 tenants, a number that grew to nearly 1,000 Entra tenants by the following day, with more than 300 sign-ins succeeding. The targeted industries included aerospace and defense, semiconductors, government, and think tanks, totaling 14 sectors.

The deployment of ARTEX marks a shift in how threat actors conduct penetration testing, as the framework can integrate with any AI model. Public reports have linked similar tools to recent breaches at South Korean financial institutions, where the suspect was allegedly using the framework with Anthropic’s Claude Code. In response to the growing threat, the developer of ARTEX has announced that the project will no longer be updated and will transition to closed source, potentially altering the landscape for future attackers.

ConnectWise has suspended several of its cloud services as a precaution and is in the process of a phased restoration, which is expected to take several days. Microsoft advises customers to keep affected app connections disabled until formal instructions are issued and to review recent logs for signs of compromise. It remains uncertain how the initial ConnectWise credentials were stolen or exactly how many tenants suffered data access, as a successful sign-in does not automatically indicate data exfiltration.