2,250 Microsoft 365 Tenants Targeted in AI-Driven Supply Chain Breach

Microsoft revealed on Thursday that a China-state-aligned threat group has deployed artificial intelligence agents in a massive supply chain attack targeting the ConnectWise platform. The incident marks a significant escalation in how threat actors exploit multi-tenant applications, utilizing an open-source agentic AI framework to automate penetration testing at a speed that outpaces traditional defensive measures. This latest development underscores the growing reliance on autonomous AI systems in cyber operations, forcing organizations to rethink their detection strategies against machine-speed attacks.

The scale of the operation is substantial, with the group attempting sign-ins at more than 2,250 Microsoft 365 tenants. By leveraging stolen ConnectWise application credentials, the attackers authenticated as the applications themselves, bypassing the need for interactive user sign-ins. The efficiency of the AI-driven process was stark; in several instances, the attackers achieved privileged access in less than three hours after initial targeting. Additionally, automated password spraying campaigns hit 327 accounts across eight organizations, generating over 151,000 failed logon attempts without achieving a single success.

The actor behind the campaign, identified as Storm-0940, has been active since 2021 and has no known industry aliases. Microsoft describes the group as a developing actor with ties to the Chinese state. The attack focused on high-value sectors, including aerospace and defense, semiconductors, government agencies, and think tanks, with 14 specific industries listed. Microsoft clarified that the breach did not stem from a vulnerability in its own systems, products, or services, but rather from the compromise of the ConnectWise multi-tenant application.

At its peak on Oct. 11, the password spray activity reached 2,900 attempts per minute, resulting in more than 111,000 failures that day. While nearly 98% of these attempts were locked out, the attackers leveraged control over multiple ConnectWise cloud app identities to sign into customer tenants from the same IP range. In one burst, more than 200 sign-ins occurred in under four minutes using just four application credentials. Within affected tenants, the AI agents performed Graph and directory operations, conducted reconnaissance, and modified app credentials, identities, groups, and privileged roles.

Huntress, a security firm, observed one tenant where an application added itself to the top administrator role on Oct. 15, triggering a Microsoft Defender alert for self-assigned Global Administrator roles. The attackers also planted new secrets set to expire in 2028. By Oct. 16, Huntress confirmed unauthorized sign-ins for 162 tenants, a number that swelled to almost 1,000 Entra tenants with activity from the attacking IP the following day, with more than 300 sign-ins succeeding. The sequential, rapid nature of the sweep suggested a script working from a pre-defined target list.

The use of ARTEX, an open-source framework of LLM-driven agents, allowed the attackers to conduct autonomous penetration tests with minimal human interaction. This technology, which can utilize any AI model, has been linked to recent breaches at South Korean financial institutions. In response to the framework's adoption by threat actors, its developer, known as Autumn-27, announced that the project would become closed source and cease updates. ConnectWise has suspended several services as a precaution, with recovery expected to take several days, while Microsoft advises customers to keep affected app connections disabled until further notice.

The stakes are high for the Southwest and broader enterprise sectors, as the attack highlights how quickly AI agents can traverse tenant boundaries. With recovery efforts ongoing and no immediate indication that partner backup data was compromised, organizations are advised to review logs from this month. The incident serves as a warning that the pace of cyberattacks is accelerating, leaving defenders with little time to detect and respond to sophisticated, AI-assisted intrusions.