2,250: The Tenant Count in a New AI-Driven Supply Chain Heist

More than 2,250 distinct cloud tenants became the target of a sophisticated cyberattack this month, a scale of intrusion that highlights the accelerating pace of modern threats. The operation was executed by a China-state-aligned group known as Storm-0940, which utilized a multi-tenant application platform called ConnectWise as its entry point. By exploiting unauthorized access to this software, the attackers were able to authenticate into numerous Microsoft 365 environments without requiring interactive user logins, effectively bypassing standard human verification steps.

The speed of the intrusion was the most alarming aspect of the event. In several instances, the attackers achieved privileged access to administrative roles within less than three hours of initially targeting a specific organization. This rapid escalation was made possible by the use of ARTEX, an open-source framework designed for agentic artificial intelligence penetration testing. ARTEX employs large language model-driven agents that can perform autonomous security assessments, including scanning, reconnaissance, and password spraying, around the clock with minimal human oversight. This automated approach allowed the group to execute operations at a velocity that left defenders with very little time to detect and respond to the activity.

Background on the operation reveals that the attackers focused on high-value sectors, including aerospace, defense, semiconductor, government, and think tanks. Microsoft noted that the incident did not stem from a vulnerability in its own systems but rather from the compromise of the third-party ConnectWise application. The group also conducted a separate password spraying campaign, targeting 327 accounts across eight organizations. This effort resulted in over 151,000 failed login attempts, with no successful breaches reported from that specific vector, though nearly 98% of the activity triggered account lockouts.

Reactions from the security community have focused on the novelty of using an open-source AI framework for such a large-scale supply chain attack. Huntress, a security firm, observed specific behaviors in one tenant on October 15, where an application automatically assigned itself to the top administrator role. By October 16, Huntress had confirmed unauthorized sign-ins for 162 tenants, a number that grew to nearly 1,000 tenants with sign-in activity from the attacking IP address by the following day. The systematic nature of the sweep, moving through tenants in sorted order with only seconds between attempts, indicated the use of a script working from a pre-defined target list.

The development of the ARTEX tool has also drawn attention from other cybersecurity firms. CrowdStrike recently linked the same framework to breaches at South Korean financial institutions, alleging the use of specific AI models in those separate attacks. The developer of ARTEX has announced that the project will no longer be updated and will transition to closed source, a move that may slow further adoption of the tool. Meanwhile, ConnectWise has suspended several of its services as a precaution and has begun a phased restoration process, with recovery expected to take several days. While the company has not found indicators that partner backup data was compromised, Microsoft advises customers to keep affected app connections disabled until formal instructions are issued and to review recent activity logs where possible.

This incident marks a significant shift in how threat actors operate, demonstrating that automated AI agents can now execute complex, multi-tenant attacks with a level of speed and scale previously reserved for highly manual operations. For organizations relying on third-party SaaS applications, the risk of supply chain compromises has increased, necessitating a closer review of how application credentials are managed and monitored. The next steps for affected businesses will involve a detailed audit of their Entra tenant logs to determine the full extent of the unauthorized access and to ensure that any planted secrets or modified roles are properly revoked.