Hackers Weaponize Autonomous AI Agents to Breach Thousands of Cloud Tenants
China-aligned attackers are using an open-source AI framework to rapidly escalate privileges and target cloud accounts at scale.
By Malik Salazar ·
The speed of cyberattacks is accelerating as artificial intelligence tools become part of the standard toolkit for threat actors. Microsoft has detailed a significant supply chain attack involving ConnectWise where a state-aligned group deployed autonomous AI agents to compromise cloud environments.
According to Microsoft's Security blog, the China-aligned actor known as Storm-0940 utilized ARTEX, an open-source agentic AI penetration testing framework, during the assault on ConnectWise's multi-tenant application. Following unauthorized access to the application, the group attempted to sign in to more than 2,250 Microsoft 365 tenants using stolen credentials. In some instances, the attackers achieved privileged access in less than three hours from the initial targeting.
The attack utilized automated password spraying techniques, targeting 327 accounts across eight organizations. This resulted in over 151,000 failed logons, though none succeeded. Microsoft noted that the use of ARTEX, a system designed to run autonomous penetration tests using LLM-driven agents, accelerated scanning, reconnaissance, and password spraying activities. These agents operate around the clock with minimal human interaction, a pace that leaves defenders with little time to detect and respond.
Storm-0940 has been active since 2021 and is described as a China-state aligned actor. The group targeted industries including aerospace and defense, semiconductors, government, and think tanks. Microsoft clarified that this activity did not result from a compromise of or a vulnerability in Microsoft's own systems, products, or services.
On October 11, the password spray activity reached a peak of 2,900 attempts per minute, all of which failed. However, by gaining control of the identities of multiple ConnectWise cloud apps, the attacking AI agents signed in to customer tenants from the same IP range using those apps' credentials. More than 200 sign-ins occurred in under four minutes using four application credentials, with operations including Graph and directory operations, reconnaissance, and changes to identities and roles.
Security firm Huntress observed unauthorized activity on October 15, where an application added itself to the top administrator role within a tenant. By October 16, Huntress confirmed unauthorized sign-ins for 162 tenants, a number that grew to almost 1,000 Entra tenants the following day, with more than 300 succeeding. The methodical sweep through tenants indicated a script working from a target list.
ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management as a precautionary measure. The company has initiated a phased restoration process expected to take several days but reports no indicators to date that partner backup data was compromised.
Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review activity from this month where logs allow. The company notes that an affected app or a successful sign-in does not necessarily indicate that data was accessed or taken. Additionally, the developer of ARTEXT has announced on GitHub that the project will no longer be updated and will become closed source.
While Microsoft has no evidence suggesting its own systems were compromised in this specific incident, the breach highlights the evolving nature of cloud security. The use of AI agents allows attackers to bypass traditional detection methods by automating credential abuse and privilege escalation at machine speed. The incident remains under investigation regarding how the initial credentials were stolen.
