Chinese Hackers Leverage AI Agents to Breach Thousands of Microsoft Tenants

The integration of artificial intelligence into cyber operations has accelerated the pace of threats, forcing defenders to react faster than ever. On October 23, Microsoft revealed that a China-state-aligned group known as Storm-0940 used an open-source AI penetration testing framework to conduct a massive supply chain attack through ConnectWise.

The first key development involves the sheer scale of the intrusion. After gaining unauthorized access to the multi-tenant application, the attackers attempted sign-ins at more than 2,250 Microsoft 365 tenants. They used stolen ConnectWise application credentials to authenticate without interactive user sign-ins. In some cases, the group achieved privileged access less than three hours after initially targeting a tenant.

The second major factor is the automated nature of the attack. The group employed ARTEX, a system of large language model-driven agents that run autonomous penetration tests. This technology sped up scanning, reconnaissance, and password spraying. The agents operated around the clock with minimal human interaction, leaving defenders with little time to detect and respond. While password spraying targeted 327 accounts across eight organizations with over 151,000 failed logons, the primary breach leveraged the compromised application credentials.

The third point concerns the speed and precision of the operations. At its peak on October 11, the password spray generated 2,900 attempts per minute, resulting in over 111,000 failures for that day. However, the AI agents signed into customer tenants from the same IP range using the app credentials. More than 200 sign-ins occurred in under four minutes using just four application credentials. Actions included directory operations, reconnaissance, and changes to privileged roles.

Context from the investigation shows that Storm-0940 has been active since 2021 and targets industries such as aerospace, defense, semiconductors, government, and think tanks. Microsoft confirmed that the attack did not stem from a vulnerability in its own systems. In one specific tenant, security firm Huntress observed an app adding itself to the top administrator role on October 15. By October 17, the firm confirmed unauthorized sign-ins for nearly 1,000 Entra tenants, with more than 300 succeeding. The sequential nature of the sweep indicated a script working from a target list.

The use of ARTEX marks a shift from traditional methods, as the framework can utilize any AI model. Public reporting this month linked the technology to breaches at South Korean financial institutions. The developer of ARTEX announced that the project will no longer be updated and will become closed source. ConnectWise has suspended several services as a precaution and has begun a phased restoration. Recovery is expected to take several days, and there are currently no indicators that partner backup data was compromised.

Outlook for organizations remains cautious. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued. Users should also review activity from this month where logs allow. The incident highlights the growing risk of AI-driven agents in supply chain attacks, which can traverse tenant boundaries with unprecedented speed and efficiency.