Storm-0940 Breach: AI Agents Target 2,250 Tenants

Microsoft attributed a major supply chain attack to Storm-0940, a China-state-aligned threat actor that utilized an open-source AI framework to breach over 2,250 Microsoft 365 tenants. The group gained unauthorized access to a multi-tenant ConnectWise application and began attempting sign-ins across customer environments. In some instances, the attackers reached privileged access levels less than three hours after the initial targeting began.

The intrusion relied on stolen credentials belonging to ConnectWise applications. This allowed the attackers to authenticate as the apps themselves without requiring interactive user sign-ins. Microsoft stated that the group used ARTEX, described as a system of large language model-driven agents that run autonomous penetration tests. The framework accelerated scanning, reconnaissance, password spraying, and the abuse of OAuth applications, enabling continuous operations with minimal human involvement.

Storm-0940 has been active since 2021 and targets 14 specific industries, including aerospace, defense, semiconductors, and government entities. Microsoft clarified that the attack did not stem from a vulnerability in its own systems or products. A parallel password-spraying campaign targeted 327 accounts across eight organizations, resulting in over 151,000 failed logons. The spray peaked on Oct. 11 at 2,900 attempts per minute, with nearly 98% of the activity resulting in lockouts.

The identity takeover of ConnectWise cloud apps proved more effective than the password spraying. Using four application credentials, the AI agents recorded more than 200 sign-ins in under four minutes from the same IP range. Within these tenants, the agents performed directory operations, changed app credentials, and modified privileged roles. Security firm Huntress observed one tenant on Oct. 15 where an app added itself to the Global Administrator role, triggering a Microsoft Defender alert.

By Oct. 16, Huntress confirmed unauthorized sign-ins at 162 tenants. A day later, the firm counted almost 1,000 Entra tenants with sign-in activity from the attacking IP, with more than 300 of those sign-ins being successful. The attackers moved through tenants in sorted order, seconds apart, a pattern Huntress described as a script working from a target list. The use of ARTEX distinguishes this campaign from traditional attacks, as the framework can operate with any AI model.

Public reporting this month linked ARTEX to breaches at South Korean financial institutions. CrowdStrike identified the suspect in those separate attacks as likely based in China and allegedly using ARTEX with Anthropic's Claude Code. Reuters reported that the developer of ARTEX, known as Autumn-27, announced on GitHub that the project would become closed source and would no longer be updated.

ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management as a precaution after detecting the unauthorized access. The company has begun a phased restoration expected to take several days and reported no indicators that partner backup data was compromised. Microsoft advised customers to keep affected app connections disabled until formal restoration instructions are issued and to review activity from this month where logs permit.

The company noted that a successful sign-in does not necessarily mean data was accessed or taken. The restoration process will determine the full scope of the compromise. ConnectWise plans to reinstate services as validation steps are completed.