AI Agents Breach 2,250 Cloud Tenants

Microsoft identified Storm-0940 as the actor behind a supply chain attack that used AI agents to breach over 2,250 Microsoft 365 tenants. The group leveraged an open-source framework called ARTEX to automate the intrusion. This allowed the attackers to move through customer accounts with minimal human intervention. Some intrusions achieved privileged access in less than three hours from the initial targeting.

The attackers stole credentials for ConnectWise applications to authenticate without user interaction. They targeted 14 industries, including aerospace, defense, semiconductors, and government. A parallel password-spraying campaign hit 327 accounts across eight organizations. This effort generated over 151,000 failed logons with no successes. On Oct. 11, the spray peaked at 2,900 attempts per minute, locking out nearly 98% of the activity.

Huntress, a security firm, tracked the intrusions in real-time. On Oct. 15, they observed an app adding itself to the Global Administrator role. The attackers planted new secrets set to expire in 2028. By Oct. 16, Huntress confirmed unauthorized sign-ins at 162 tenants. The next day, they counted almost 1,000 Entra tenants with activity from the attacking IP. More than 300 of those sign-ins were successful. The attackers moved through tenants in sorted order, seconds apart.

Microsoft stated that the attack did not stem from a vulnerability in its own systems. The company described ARTEX as a system of LLM-driven agents that run autonomous penetration tests. These agents sped up scanning, reconnaissance, and password spraying. The framework can operate around the clock with little human involvement. This leaves defenders very little time to detect and respond to the intrusion.

ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management as a precaution. The company has begun a phased restoration expected to take several days. It reports no indicators that partner backup data was compromised. Microsoft advised customers to keep affected app connections disabled until formal restoration instructions are issued. Customers should review activity from this month where logs permit.

Reuters reported that ARTEX’s developer, known as Autumn-27, said on GitHub that the project would become closed source. The developer stated the project will no longer be updated. CrowdStrike linked the tool to separate breaches at South Korean financial institutions. Those attackers were likely based in China and allegedly used ARTEX with Anthropic’s Claude Code. The use of a pentest framework that works with any AI model distinguishes this campaign from traditional attacks.