Storm-0940 leverages AI agents to probe over 2,000 Microsoft tenants

The pace of modern cyberattacks is accelerating to a point where human reaction times may no longer be sufficient.

Microsoft has disclosed that a threat group known as Storm-0940 utilized an open-source artificial intelligence framework to execute a large-scale supply chain attack. The operation targeted ConnectWise, a multi-tenant application, allowing the attackers to attempt sign-ins at more than 2,250 distinct Microsoft 365 tenants. By using stolen credentials associated with ConnectWise applications, the group was able to authenticate as those apps without requiring an interactive user login. In some instances, the attackers achieved privileged access within less than three hours of initially targeting a tenant.

The core of this operation was ARTEX, a system of large language model driven agents designed to run autonomous penetration tests. Microsoft notes that this technology significantly sped up scanning, reconnaissance, and the abuse of OAuth applications. The agents operate continuously with minimal human interaction, a speed that leaves defenders with very little time to detect and respond to intrusions. It remains unclear how the initial ConnectWise credentials were stolen or exactly how many tenants were ultimately compromised by this automated sweep.

Storm-0940 is described as a China-state aligned actor that has been active since 2021. The group has no known industry aliases, and its name follows the convention used for developing threat actors. This specific campaign targeted industries including aerospace, defense, semiconductor manufacturing, government agencies, and think tanks, with 14 specific sectors listed in total. Microsoft emphasized that the activity did not stem from a vulnerability or compromise within its own systems, products, or services.

The attack featured intense automated password spraying, which targeted 327 accounts across eight organizations. This resulted in more than 151,000 failed logons, with no successful entries recorded during this phase. On October 11, the activity peaked with 2,900 attempts per minute, totaling more than 111,000 attempts for that day. Forty-eight accounts logged more than 1,000 failures each. Nearly 98% of this activity resulted in lockouts, suggesting that while the brute force approach was noisy, it may have been a preliminary step to identify vulnerable targets.

Once the AI agents controlled the identities of multiple ConnectWise cloud apps, they signed into customer tenants using those application credentials from the same IP range. The agents executed more than 200 sign-ins in under four minutes using just four application credentials. Within some tenants, the group performed Graph and directory operations, conducted reconnaissance, and made changes to app credentials, identities, groups, and privileged roles.

Huntress, a security firm, observed specific behaviors on October 15 when an app added itself to the top administrator role. This triggered a Microsoft Defender alert for an application self-assigning a Global Administrator role. The attackers also planted new secrets set to expire in 2028. By October 16, Huntress confirmed unauthorized sign-ins for 162 tenants. The following day, that number rose to almost 1,000 Entra tenants with sign-in activity from the attacking IP, with more than 300 sign-ins succeeding. The fact that the attack swept through tenants in sorted order, with only a few seconds between attempts, indicated that a script was working from a pre-defined target list.

This incident is notable for its reliance on ARTEX, an open-source framework that can utilize any AI model. Threat actors in multiple regions are adopting this technology, with recent reports linking it to breaches at South Korean financial institutions. CrowdStrike stated that the suspect in those separate attacks was likely based in China and allegedly used ARTEX with Anthropic’s Claude Code. The developer of ARTEX, who uses the handle Autumn-27, announced on GitHub that the project will no longer be updated and will become closed source, a move that could affect its future availability in the security community.

ConnectWise has suspended Cloud Backup, SaaS Security, and Cloud Management as a precaution following the unauthorized access. A phased restoration process has begun, with full recovery expected to take several days. The company reports no indicators to date that partner backup data was compromised. Microsoft advises customers that an affected app or successful sign-in does not necessarily mean data was accessed or taken. Users are encouraged to keep affected app connections disabled until formal restoration instructions are issued and to review activity logs from this month where possible.