AI Agents Hit 2,250 Microsoft 365 Tenants in ConnectWise Breach

Autonomous AI agents attempted sign-ins at more than 2,250 Microsoft 365 tenants during the ConnectWise supply chain attack, and some intrusions reached privileged access in under three hours, Microsoft disclosed in its Security blog. The actor, tracked as Storm-0940 and described as a "China-state aligned actor" with "no known industry aliases," ran the operation with ARTEX — an open-source, LLM-driven penetration testing framework that Microsoft calls "a system of LLM-driven agents that run an autonomous penetration test."

The stolen ConnectWise app credentials needed no user sign-in at all. They authenticated as the apps themselves, non-interactively. That's what made them dangerous.

How fast did the agents move?

Fast enough, Microsoft wrote, that the pace "leaves defenders with little time to detect and respond." The agents worked around the clock "with little needed human interaction," accelerating scanning and reconnaissance, password spraying and OAuth application abuse.

The numbers are blunt:

• Password spraying hit 327 accounts across eight organizations with more than 151,000 failed logons — and zero successes.
• At the Oct. 11 peak, the spray ran 2,900 attempts per minute, all failures, totaling more than 111,000 attempts that day.
• 48 accounts logged more than 1,000 failures each; almost 98% of the activity was locked out.
• Controlling identities of multiple ConnectWise cloud apps, the agents executed more than 200 sign-ins in under four minutes using four application credentials, from a single IP range.

Inside affected tenants, the agents performed Graph and directory operations, reconnaissance, app credential changes, and changes to identities, groups and privileged roles.

What did investigators see in the tenants?

Security firm Huntress watched one tenant on Oct. 15 where an app added itself to the top administrator role — the behavior behind Microsoft Defender's alert "Application self-assigned Global Administrator role." The agents also planted new secrets set to expire in 2028. Huntress confirmed unauthorized sign-ins at 162 tenants by Oct. 16; a day later it counted almost 1,000 Entra tenants with sign-in activity from the attacking IP, with more than 300 succeeding.

The tenants were hit in sorted order, a few seconds apart. Huntress concluded it was "a script working from a target list."

Microsoft stressed the activity "did not result from a compromise of or a vulnerability" in its own systems, products or services. Fourteen industries were targeted in total, including aerospace and defense, semiconductor, government and think tanks. It remains unclear how the ConnectWise credentials were stolen or how many tenants were actually compromised.

Storm-0940 has been active since 2021; the naming convention marks it as a developing actor.

Who else is using ARTEX?

Threat actors in multiple regions now use the framework, which Microsoft says can run on any AI model. Public reporting this month tied it to breaches at South Korean financial institutions. CrowdStrike said the suspect in those separate attacks was likely based in China and allegedly used ARTEX with Anthropic's Claude Code.

ARTEX's developer, who goes by the handle "Autumn-27," wrote on GitHub that the project "will no longer be updated" and would become closed source, Reuters reported.

What is ConnectWise doing?

ConnectWise confirmed the unauthorized access and suspended Cloud Backup (formerly Skykick), SaaS Security and Cloud Management as a precaution. A phased restoration is underway, expected to take several days, and the company says it has no indicators to date that partner backup data was compromised.

Microsoft cautions that an affected app, or even a successful sign-in, doesn't necessarily mean data was accessed or taken. It advises customers to keep affected app connections disabled until formal restoration instructions arrive, and to review this month's activity wherever logs allow.

With agentic tooling now open-source and region-agnostic, the gap between automated attack speed and human response time is set to widen further.