Hackers use AI to break into thousands of Microsoft accounts

Microsoft says a China-aligned hacking group deployed autonomous AI agents to break into thousands of corporate Microsoft 365 accounts as part of a large-scale supply chain attack. The group, identified by Microsoft as Storm-0940, used an open-source tool to automate much of the break-in. Microsoft wrote in its Security blog that the attackers attempted sign-ins at more than 2,250 Microsoft 365 tenants. In some cases, the attackers gained privileged access in less than three hours after first targeting a system.

The attackers got their foothold through unauthorized access to a multi-tenant application connected to ConnectWise. Microsoft says the group used stolen credentials from this app to sign in without needing a user to enter a password. The activity targeted a wide range of industries, including aerospace and defense, semiconductor, government, and think tanks, with 14 industries listed in total. Microsoft noted that the breach did not come from a vulnerability in its own systems or products.

The method used in this attack stands out because it relied on ARTEX, an open-source tool for automated penetration testing. Microsoft describes ARTEX as a system of LLM-driven agents that run an autonomous penetration test. These AI agents can scan systems, guess passwords, and misuse application permissions with little needed human interaction. The agents can work around the clock at a pace that leaves defenders with little time to detect and respond. It is still uncertain how the ConnectWise credentials were stolen or how many tenants were actually compromised.

Storm-0940 has been active since 2021. Microsoft classifies the group as a China-state aligned actor with no known industry aliases. The name follows the convention for a developing actor. The campaign involved attempts to log into accounts across 327 accounts at eight organizations. These attempts generated more than 151,000 failed logons and no successful sign-ins. On Oct. 11, the password spray reached 2,900 attempts per minute, with more than 111,000 attempts for that day. Almost 98% of this activity was locked out.

With control of the identities of multiple ConnectWise cloud apps, the attacking AI agents signed in to customer tenants using those apps’ credentials. In one case, more than 200 sign-ins occurred in under four minutes using four application credentials. Operations taken within some tenants included Graph and directory operations, reconnaissance, app credential changes, as well as changes to identities, groups, and privileged roles. The attack's sweep through tenants in sorted order, a few seconds apart, indicated a script working from a target list.

Security firm Huntress observed a specific instance of this behavior on Oct. 15. In one tenant, Huntress saw an app add itself to the top administrator role. This is the behavior behind the Microsoft Defender alert Application self-assigned Global Administrator role. Actions included planting new secrets set to expire in 2028. Huntress confirmed unauthorized sign-ins for 162 tenants by Oct. 16. A day later, it found almost 1,000 Entra tenants with sign-in activity from the attacking IP, with more than 300 succeeding.

The use of an open-source pentest framework that can use any AI model sets this attack apart from many traditional attacks. Microsoft says threat actors in multiple regions are using the technology. Public reporting this month tied it to breaches at South Korean financial institutions. CrowdStrike said the suspect in those separate attacks was likely based in China and allegedly used ARTEX with Anthropic’s Claude Code. ARTEX’s developer, who goes by the handle Autumn-27, said on GitHub that the ARTEX project will no longer be updated and would become closed source, Reuters reported.

ConnectWise noted the unauthorized access and suspended Cloud Backup, formerly SkyKick, as well as SaaS Security and Cloud Management as a precaution. It has started a phased restoration with recovery expected to take several days. ConnectWise has no indicators to date that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued. Customers should also review activity from this month where logs allow.

Microsoft notes that an affected app, or even a successful sign-in, does not necessarily mean data was accessed or taken. The company is continuing to monitor the situation. Customers are advised to wait for instructions regarding the restoration of connections. The investigation into how the credentials were stolen is ongoing.