Storm-0940 Hacked 2,250 Microsoft Tenants Using AI Agents

Microsoft identified a China-state-aligned threat actor as the source of a massive supply chain attack that targeted over 2,250 Microsoft 365 tenants. The intrusion exploited vulnerabilities in ConnectWise, a third-party application, to gain unauthorized access to customer environments.

The attackers, designated Storm-0940, leveraged an open-source agentic AI penetration testing framework known as ARTEX. This system utilizes large language model agents to conduct autonomous security tests. According to Microsoft, the tool accelerated scanning, password spraying, and the abuse of OAuth applications. The agents operated with minimal human intervention, reducing the window for defenders to detect anomalies.

Storm-0940 has been active since 2021 and lacks established industry aliases. The campaign targeted 14 sectors, including aerospace, defense, semiconductors, and government entities. Microsoft clarified that the breach did not originate from a flaw in its own systems or products. The group used stolen credentials belonging to ConnectWise apps to authenticate directly as the applications, bypassing interactive user sign-ins.

The attack unfolded in distinct phases. A parallel password-spraying effort targeted 327 accounts across eight organizations, resulting in more than 151,000 failed logons. At its peak on October 11, the spray rate reached 2,900 attempts per minute. Almost 98% of these attempts were locked out, with no successful logins recorded from this specific vector.

The more effective vector involved the identity takeover of several ConnectWise cloud apps. Using four application credentials, the AI agents signed in to customer tenants from a shared IP range. They recorded more than 200 sign-ins in under four minutes. Within specific tenants, the attackers performed directory operations, changed app credentials, and modified privileged roles.

Security firm Huntress observed a tenant on October 15 where an app added itself to the Global Administrator role. This action triggered a Microsoft Defender alert for an application self-assigned privilege. The attackers planted new secrets with expiration dates set for 2028. By October 16, Huntress confirmed unauthorized sign-ins at 162 tenants. A day later, the count rose to nearly 1,000 Entra tenants with activity from the attacking IP, including more than 300 successful sign-ins.

The attackers moved through tenants in sorted order with intervals of only seconds, suggesting a scripted process. Microsoft noted that the use of a flexible AI framework distinguishes this campaign from traditional attacks. Public reports have linked ARTEX to breaches at South Korean financial institutions. The developer of ARTEX, known as Autumn-27, announced on GitHub that the project would become closed source and would no longer receive updates.

ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management services as a precaution. The company has begun a phased restoration expected to take several days and reports no indicators that partner backup data was compromised. Microsoft advised customers to keep affected app connections disabled until formal restoration instructions are issued and to review activity logs from this month where possible.