2,250 tenants targeted as AI hackers speed up network infiltration

For many Midwest businesses, the recent discovery means immediate changes to how digital identities are managed. A massive cyberattack exposed a gap in how third-party applications access internal networks, forcing companies to scrutinize their security settings. The incident highlights a shift toward faster, more automated threats that leave less time for standard defenses to react.

The scale of the operation is defined by precise numbers. The attackers attempted to sign into more than 2,250 Microsoft 365 tenants. In a specific burst of activity, over 200 sign-ins were executed in under four minutes using just four stolen application credentials. The speed was remarkable, with some attacks reaching privileged access levels in less than three hours. During a peak period on Oct. 11, the group made 2,900 login attempts per minute, totaling more than 111,000 attempts that day.

The perpetrators are identified as Storm-0940, a group aligned with the Chinese state and active since 2021. This is not a new entity, but its methods have evolved. The group utilized ARTEX, an open-source framework that drives large language model agents to perform autonomous penetration testing. These agents handled scanning, reconnaissance, and password spraying with minimal human input. This automation allowed the attackers to operate continuously, overwhelming defenders who traditionally rely on slower, manual detection processes.

The targets included 14 specific industries, ranging from aerospace and defense to semiconductors and think tanks. The attack vector was a supply chain compromise involving ConnectWise, a multi-tenant application provider. Once the group gained unauthorized access to ConnectWise, they leveraged stolen application credentials to authenticate into customer tenants. These logins appeared as valid app connections rather than interactive user sign-ins, making them harder to spot immediately. Microsoft confirmed that the issue did not stem from a vulnerability in its own systems or products.

The stakes for organizations are high because the attackers moved quickly to establish control. In some cases, they changed app credentials, modified identities, and adjusted privileged roles. Huntress, a security firm, observed one tenant where an application added itself to the top administrator role. This action triggered alerts for self-assigned global administrator roles. The attackers also planted new secrets set to expire in 2028, a move designed to ensure long-term access if initial connections were severed. By Oct. 16, unauthorized sign-ins were confirmed in 162 tenants, a number that grew to almost 1,000 tenants with active sign-in behavior from the attacking IP address by the following day.

ConnectWise has suspended several services, including Cloud Backup and SaaS Security, as a precautionary measure. A phased restoration process has begun, with recovery expected to take several days. There are currently no indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal instructions are issued. The incident underscores a broader trend where threat actors in multiple regions are adopting these AI-driven tools to accelerate breaches. As the ARTEX project moves to closed source, the competitive advantage it provided may shift, but the lesson for defenders remains: speed is the new currency in cyber defense.

The attack demonstrated that traditional perimeter defenses are no longer sufficient. The systematic sweep through tenants, occurring in sorted order just seconds apart, indicated a script working from a predefined target list. This level of coordination and automation suggests a sophisticated operation designed to maximize impact before detection. For ordinary people in corporate roles, the message is clear: vigilance over third-party integrations is now a critical part of daily security routine. The days of assuming an app connection is safe are fading.