AI-Powered Hackers Breach 2,250 Microsoft Tenants in Supply Chain Strike

China-state-aligned cyber actors have deployed autonomous artificial intelligence agents to execute a massive supply chain attack, attempting sign-ins across more than 2,250 Microsoft 365 tenants in a single coordinated wave. This operation represents a significant shift in how threat actors leverage technology, utilizing the open-source framework ARTEX to accelerate reconnaissance and credential abuse at a pace that traditional defense mechanisms struggle to match. The scale of the intrusion highlights the growing financial and operational risks posed by AI-driven penetration testing tools in the enterprise sector.

The attack relied on stolen credentials from ConnectWise, a multi-tenant application, which allowed the AI agents to authenticate without interactive user sign-ins. By leveraging these application identities, the attackers bypassed standard user authentication protocols. Microsoft identified the actor as Storm-0940, a group active since 2021 with no known industry aliases. The use of ARTEX, described as a system of large language model-driven agents, enabled the group to conduct autonomous penetration tests, speeding up scanning, password spraying, and OAuth application abuse with minimal human intervention.

Speed was the defining characteristic of this campaign. In several instances, the attackers achieved privileged access to tenant environments less than three hours after initial targeting. This rapid escalation left defenders with very little time to detect anomalies and respond. The AI agents operated continuously, working around the clock to exploit vulnerabilities in identity management systems. This efficiency contrasts sharply with slower, manual attack methods, placing new pressure on IT security teams to monitor for high-velocity access patterns.

The campaign targeted specific high-value industries, including aerospace and defense, semiconductors, government agencies, and think tanks. In total, fourteen industries were listed among those affected. Despite the widespread reach, Microsoft clarified that the breach did not stem from a vulnerability in its own systems, products, or services. Instead, the intrusion was a result of unauthorized access to the ConnectWise application, which served as the entry point for the AI-driven agents to move laterally across customer tenants.

Automated password guessing, known as password spraying, formed a secondary component of the attack. Agents targeted 327 accounts across eight organizations, generating over 151,000 failed logons with no successful breaches during that specific phase. At its peak on October 11, the spraying operation recorded 2,900 attempts per minute, exceeding 111,000 failures for the day. While nearly 98% of these attempts were locked out, the sheer volume of traffic created significant noise in security logs, potentially masking other malicious activities.

The most consequential phase involved the direct use of ConnectWise application credentials to sign in to customer tenants. Within four minutes, agents executed more than 200 sign-ins using just four application credentials from a shared IP range. Once inside, the agents performed directory operations, reconnaissance, and changes to app credentials, identities, and privileged roles. In one instance on October 15, security firm Huntress observed an application adding itself to the top administrator role, a behavior that triggered specific alerts in Microsoft Defender.

By October 16, Huntress had confirmed unauthorized sign-ins for 162 tenants, a figure that surged to nearly 1,000 Entra tenants the following day. More than 300 of these sign-ins were successful. The systematic nature of the sweep, with attempts occurring in sorted order just seconds apart, indicated the use of a script working from a predefined target list. This methodical approach underscores the efficiency of the AI agents in processing and exploiting a large number of targets simultaneously.

The broader context reveals that ARTEX is not unique to this single group. Threat actors in multiple regions are adopting this technology, with recent public reports linking its use to breaches at South Korean financial institutions. CrowdStrike suggested that the suspects in those attacks were likely based in China and used ARTEX with Anthropic’s Claude Code. In response to the widespread adoption and potential for misuse, the developer of ARTEX, known as Autumn-27, announced on GitHub that the project would no longer be updated and would transition to closed source.

ConnectWise has responded by suspending several services, including Cloud Backup, SaaS Security, and Cloud Management, as a precautionary measure. A phased restoration process has begun, with full recovery expected to take several days. While there are no current indicators that partner backup data was compromised, the incident has prompted Microsoft to advise customers to keep affected app connections disabled until formal restoration instructions are issued. The event serves as a critical reminder for businesses to review recent activity logs and prepare for the evolving threat landscape driven by AI automation.

The deployment of ARTEX marks a turning point in supply chain security, demonstrating that autonomous agents can compress the timeline from initial access to privileged control into mere hours. For New England businesses and their counterparts nationwide, this event underscores the need for robust monitoring of application identities and rapid response protocols. As AI tools become more accessible and powerful, the cost of delayed detection is rising, making proactive security investments essential for maintaining operational continuity.