2,250 Tenants: AI Agents Sweep Microsoft 365 in Rapid Supply Chain Strike

The intersection of artificial intelligence and cyber espionage has reached a critical inflection point, as a China-aligned threat actor demonstrated the speed and scale possible with autonomous AI agents. In a major supply chain attack detailed by Microsoft, the group known as Storm-0940 utilized a tool called ARTEX to launch a widespread assault on Microsoft 365 environments. The operation targeted more than 2,250 distinct tenants, showcasing how automated systems can overwhelm traditional defense timelines.

At the heart of this incident is the deployment of ARTEX, an open-source framework designed for agentic penetration testing. Rather than relying solely on human operators, the attackers used large language model-driven agents to conduct reconnaissance, scan for vulnerabilities, and execute password spraying campaigns. Microsoft notes that these agents operate with minimal human interaction, allowing for continuous activity that leaves defenders with little time to detect anomalies or respond effectively.

The speed of the intrusion was alarming. In several instances, the attacking group reached privileged access levels within three hours of initially targeting a victim. This rapid escalation was facilitated by the theft of credentials for ConnectWise applications. By authenticating as these multi-tenant apps, the attackers could bypass standard interactive user sign-ins, granting them seamless entry into customer environments without triggering typical user-based alerts.

Simultaneously, the group conducted a massive password spraying campaign. This automated guessing technique targeted 327 accounts across eight organizations, resulting in over 151,000 failed logon attempts. The peak of this activity occurred on October 11, when the system generated 2,900 attempts per minute, totaling more than 111,000 failures in a single day. While nearly 98% of these attempts were locked out, the sheer volume highlighted the brute-force capability of the AI-driven agents.

The attack was not limited to simple brute force. Using the compromised ConnectWise credentials, the agents signed into customer tenants from a specific IP range, executing more than 200 sign-ins in under four minutes using just four application credentials. Once inside, the agents performed various operations, including directory changes, reconnaissance, and modifications to identities and groups. This systematic sweep through tenants, often occurring just seconds apart, indicated a scripted approach working from a predefined target list.

Security firm Huntress observed specific behaviors in one tenant on October 15, where an application added itself to the top administrator role. This action triggered Microsoft Defender alerts and involved planting new secrets set to expire in 2028. By October 16, Huntress confirmed unauthorized sign-ins for 162 tenants, a number that grew to nearly 1,000 Entra tenants by the following day, with more than 300 successful logins attributed to the attacking IP address.

Storm-0940, active since 2021, is described as a China-state-aligned actor with no known industry aliases. The group targeted 14 industries, including aerospace and defense, semiconductors, government entities, and think tanks. Microsoft clarified that the attack did not stem from a vulnerability in its own systems but rather from the compromise of the ConnectWise multi-tenant application credentials.

The use of ARTEX marks a shift in cyber tactics. The framework, which can utilize any AI model, is being adopted by threat actors in multiple regions. Public reports this month linked the technology to breaches at South Korean financial institutions, with suspects allegedly using it alongside Anthropic’s Claude Code. In response to the growing threat, ARTEX’s developer, who uses the handle Autumn-27, announced on GitHub that the project would become closed source and cease updates.

ConnectWise has suspended its Cloud Backup, SaaS Security, and Cloud Management services as a precautionary measure while it works to restore functionality. The company expects recovery to take several days and currently sees no indicators that partner backup data has been compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review recent activity logs to assess potential exposure.

This incident underscores the evolving landscape of supply chain attacks, where AI agents can execute complex intrusions at a scale and speed previously reserved for large, coordinated human teams. For organizations in the Pacific Northwest and beyond, the lesson is clear: the window for detection and response is shrinking as autonomous tools take center stage in cyber operations.