AI agents breach thousands of business accounts

More than 2,250 Microsoft 365 tenants were targeted by automated sign-in attempts this week. This massive sweep was part of a supply chain attack that leveraged stolen credentials from ConnectWise, a multi-tenant application. The operation was carried out by a group Microsoft identifies as Storm-0940, an actor aligned with China's state interests. The scale of the attempt highlights how quickly modern tools can move through corporate networks.

The core of this operation involved ARTEX, an open-source framework designed for agentic AI penetration testing. Microsoft explains that the system uses large language model driven agents to run autonomous tests. These agents handled scanning, reconnaissance, and password spraying with minimal human interaction. The speed of these automated processes left defenders with very little time to detect and respond to the incoming threats.

In one specific sequence, the AI agents used four application credentials to sign in to customer tenants. They generated more than 200 sign-ins in under four minutes from the same IP range. This rapid execution allowed the group to perform directory operations and change app credentials. In some cases, privileged access was reached less than three hours after the initial targeting began.

Password spraying was a major component of the effort. The attackers targeted 327 accounts across eight organizations, resulting in over 151,000 failed logons. At its peak on October 11, the system made 2,900 attempts per minute. Almost 98% of this activity resulted in account lockouts, indicating that the brute force approach had limited direct success without the stolen app credentials.

Huntress, a security firm, observed specific behaviors in one tenant on October 15. They saw an application add itself to the top administrator role. The group also planted new secrets that were set to expire in 2028. By October 16, Huntress confirmed unauthorized sign-ins for 162 tenants. The following day, that number rose to nearly 1,000 tenants with activity from the attacking IP, with more than 300 of those sign-ins succeeding.

The attack targeted industries including aerospace, defense, semiconductors, government, and think tanks. Microsoft noted that the activity did not stem from a vulnerability in its own systems or products. It is currently unclear exactly how the initial ConnectWise credentials were stolen or the total number of tenants that were fully compromised.

ARTEX has become a point of interest for threat actors in multiple regions. Public reports this month linked the tool to breaches at South Korean financial institutions. The developer of ARTEX, known as Autumn-27, stated on GitHub that the project will no longer be updated and will become closed source. This shift may impact how other groups utilize the framework in the future.

ConnectWise has suspended several services as a precaution, including Cloud Backup and SaaS Security. A phased restoration process has begun, with recovery expected to take several days. There are no current indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review activity logs where possible.

The use of AI agents in this manner represents a shift in how supply chain attacks are executed. The ability to work around the clock with little human input changes the timeline for detection. As organizations recover, the focus remains on understanding how these autonomous tools can be better monitored to prevent future rapid escalations.