Microsoft Warns China-Linked Hackers Used AI Agents to Target 2,250 Microsoft 365 Tenants

A China-state-aligned cyber group leveraged an open-source artificial intelligence agent framework to execute a large-scale supply chain attack, attempting sign-ins at over 2,250 Microsoft 365 tenants, according to Microsoft. The operation, attributed to a threat actor known as Storm-0940, exploited stolen credentials to gain unauthorized access to a multi-tenant application, facilitating rapid reconnaissance and privilege escalation across numerous organizations.

Microsoft detailed the operation in a recent security blog post, stating that the activity did not originate from a vulnerability within Microsoft's own systems or products. Instead, the intrusion targeted the ConnectWise supply chain. By compromising a multi-tenant application associated with this vendor, the attackers were able to utilize application credentials to authenticate directly with customer tenants without requiring an interactive user sign-in. In some instances, the group achieved privileged access in less than three hours from the initial targeting.

Central to the attack's speed was the utilization of ARTEX, an autonomous penetration testing framework driven by large language models. Microsoft described the tool as a system capable of running autonomous penetration tests with minimal human interaction, operating continuously to accelerate scanning, reconnaissance, and password spraying. The agency of these AI agents allows them to move at a pace that leaves defenders with little time to detect and respond. Microsoft noted that the group is a China-state-aligned actor that has been active since 2021.

The malicious activity included a significant volume of automated password guessing. Across eight organizations, targeting 327 accounts, the attackers generated more than 151,000 failed logon attempts without a single success. The volume of this activity peaked on October 11, reaching 2,900 attempts per minute. Despite the high volume of failures, approximately 98% of these attempts were locked out by security measures.

However, the AI agents successfully signed in to customer tenants using credentials associated with four compromised application identities. In a span of under four minutes, over 200 sign-ins were recorded from a single IP range. Once inside, the operations included performing Graph and directory operations, reconnaissance, and modifying app credentials, identities, groups, and privileged roles.

Security firm Huntress observed specific malicious behaviors within affected tenants on October 15, noting an application that self-assigned a Global Administrator role and planted new secrets set to expire in 2028. By October 16, Huntress confirmed unauthorized sign-ins for 162 tenants. A day later, almost 1,000 Entra tenants showed sign-in activity from the attacking IP address, with more than 300 of those sign-ins succeeding.

ConnectWise has acknowledged the unauthorized access and suspended certain services, including Cloud Backup (formerly SkyKick), SaaS Security, and Cloud Management, as a precaution. A phased restoration process has begun, expected to take several days, though the company reports no indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review activity logs from this month where possible.

Microsoft also noted that an affected app or a successful sign-in does not necessarily indicate that data was accessed or stolen. The investigation into how the ConnectWise credentials were initially compromised, as well as the total number of tenants actually affected, remains ongoing.