AI Agents Breached Thousands of Corporate Cloud Accounts in Hours

More than 2,250 organizations saw their Microsoft 365 sign-in pages probed by automated tools in a matter of hours following a security breach at a software supplier, according to Microsoft.

Microsoft said its security division has traced the activity to Storm-0940, a threat group it describes as aligned with the Chinese state. The intrusions targeted a multi-tenant application belonging to ConnectWise, a company that provides IT management software. Microsoft reported that some of the unauthorized attempts succeeded in gaining privileged access to systems in less than three hours.

The method of intrusion relied on stolen application credentials for ConnectWise software, allowing the attackers to authenticate as the applications themselves without needing a user to enter a password. Microsoft stated it is still unclear how these credentials were stolen, and neither company has provided a count of how many organizations were successfully breached.

Microsoft described the tool used for the campaign as ARTEX, an open-source framework built on a system of LLM-driven agents that run an autonomous penetration test. The company noted this tool accelerated tasks including scanning and reconnaissance, password spraying, and abuse of OAuth applications. Such agents can operate around the clock with little human involvement, leaving defenders little time to detect and respond.

Storm-0940 has been active since 2021 and has no known industry aliases, with its designation following the convention for a developing actor. Microsoft reported that Storm-0940 has been active since 2021. The targets included organizations in 14 industries, such as aerospace and defense, semiconductors, government, and think tanks. Microsoft stressed that the activity did not stem from a compromise of, or a vulnerability in, its own systems, products or services.

A parallel password-spraying effort went after 327 accounts across eight organizations, producing more than 151,000 failed logons and no successes. At its peak on Oct. 11, the spray reached 2,900 attempts per minute, all unsuccessful, and more than 111,000 for the day, with 48 accounts each logging over 1,000 failures. Almost 98% of that activity was locked out.

The identity takeover of several ConnectWise cloud apps proved more effective. Using four application credentials, the AI agents signed in to customer tenants from the same IP range, recording more than 200 sign-ins in under four minutes. Within some tenants, they carried out Graph and directory operations and reconnaissance, and changed app credentials, identities, groups and privileged roles.

Security firm Huntress observed one tenant on Oct. 15 in which an app added itself to the Global Administrator role, the behavior behind the Microsoft Defender alert "Application self-assigned Global Administrator role." The actions included planting new secrets set to expire in 2028. By Oct. 16, Huntress had confirmed unauthorized sign-ins at 162 tenants. A day later it counted almost 1,000 Entra tenants with sign-in activity from the attacking IP, more than 300 of them successful. The attackers moved through tenants in sorted order, seconds apart, suggesting "a script working from a target list."

The use of a pentest framework that Microsoft says can work with any AI model sets the campaign apart from many traditional attacks. Threat actors in several regions use the tool, and public reporting this month linked it to breaches at South Korean financial institutions. CrowdStrike said the suspect in those separate attacks was likely based in China and allegedly used ARTEX with Anthropic's Claude Code. Reuters reported that ARTEX's developer, who goes by "Autumn-27," said on GitHub that the project "will no longer be updated" and would become closed source.

ConnectWise detected the unauthorized access and, as a precaution, suspended Cloud Backup (formerly SkyKick) along with SaaS Security and Cloud Management. It has begun a phased restoration expected to take several days and says it has no indicators so far that partner backup data was compromised.

Microsoft cautioned that an affected app, or even a successful sign-in, does not necessarily mean data was accessed or taken. It advised customers to keep affected app connections disabled until formal restoration instructions are issued, and to review activity from this month where logs permit.