AI Agents Targeted Thousands of Microsoft Tenants in Hack

A China-aligned hacking group used artificial intelligence to launch a massive attack on business networks this week. Microsoft reported that its security teams detected the campaign. The group, known as Storm-0940, targeted a software provider called ConnectWise. This allowed the hackers to reach into thousands of corporate accounts. Microsoft said the attackers tried to sign in to more than 2,250 Microsoft 365 tenants.

The attackers used a tool called ARTEX. This is an open-source framework for automated penetration testing. It uses AI agents to scan for weaknesses. The tool sped up the search for passwords and other entry points. These agents can work without help from humans. They can operate around the clock. Microsoft noted that this speed gives defenders little time to stop them. In some cases, the attack reached high-level access in under three hours. It is not known how the initial credentials were stolen. It is also unclear how many systems were truly compromised.

The campaign targeted sensitive industries. These include aerospace, defense, semiconductors, and government. Think tanks were also on the list. There were 14 industries in total. Microsoft stated that the issue was not a flaw in its own products. The activity came from a third party. Security firm Huntress saw one instance where an application added itself to the top administrator role. It also saw new secrets being planted. These secrets were set to expire in 2028.

The automated attacks were relentless. On October 11, the system tried 2,900 passwords in a single minute. That day saw over 111,000 failed logins. Almost 98% of that activity was locked out. However, the AI agents still found a way in. They used application credentials to sign in to customer accounts. Over 200 sign-ins happened in under four minutes. Huntress confirmed unauthorized sign-ins for nearly 1,000 Entra tenants by October 17. More than 300 of those attempts succeeded.

ConnectWise has suspended several services. These include Cloud Backup and SaaS Security. This was done as a precaution. A phased restoration process has begun. It is expected to take several days. The company stated that it has no evidence that partner backup data was compromised. Microsoft advises customers to keep affected connections disabled for now. Users should also review logs from this month. This will help identify any unusual activity.