> China-linked hackers used agentic AI in attack on 2,250 Microsoft 365 tenants

A China-state-aligned threat actor compromised a ConnectWise cloud backup application and used an open-source agentic AI framework to turn its stolen credentials against more than 2,250 Microsoft 365 tenants, Microsoft said. Microsoft Threat Intelligence attributed the activity to Storm-0940, which it said has used the ARTEX framework since as early as September 2026 to automate attacks on hundreds of organizations. In some cases, the group gained privileged cloud access less than three hours after first targeting a victim. Microsoft said the activity did not result from a compromise of or vulnerability in its own systems, products, or services. “This activity demonstrates how threat actors are integrating agentic AI into existing offensive security workflows and allows them to scale their operations exponentially,” Microsoft said in a blog post. Machine-speed sign-ins Following the breach at ConnectWise, Storm-0940 used ARTEX to attempt sign-ins to more than 2,250 tenants at 2,900 attempts per minute, the post added. ConnectWise published an initial advisory on October 16 covering attempted unauthorized access associated with its Cloud Backup product, and later expanded its containment guidance. The attackers used the identities of multiple ConnectWise cloud applications to authenticate to Microsoft 365 environments through apps that had already been granted access. That removed the need for interactive user sign-ins, the post said. In some environments, the agents moved on to Microsoft Graph and directory operations. These included reconnaissance, application credential changes to establish persistence, and changes to identities, groups, and privileged roles. Microsoft warned that such changes “can remain active as a backdoor” even after the original application is remediated. ConnectWise did not immediately respond to a request for comment. Yih Khai Wong, senior research manager for security services at IDC Asia/Pacific, said the timeline is beyond the reach of human response. “2,900 sign-in attempts per minute and gaining privileged cloud access in under three hours is not a timeline any human analyst queue can keep up with, no matter how well-staffed the SOC,” Wong said. He said containment actions such as disabling credentials, revoking tokens and isolating service principals should trigger automatically on predefined thresholds, with humans reviewing them afterward. In the face of machine-speed attacks, he added, “relying on a human to click ‘approve’ will not cut it.” Trusted apps, untrusted access Yash Kadakia, founder and CTO of Security Brigade, said the incident exposes a gap in how enterprises secure access. “Companies spend enormous amounts of time securing employee logins with MFA and conditional access, while third-party applications can hold equally powerful permissions and authenticate without any employee being involved,” Kadakia said. “We’ve spent years implementing zero trust for humans while continuing to implicitly trust machines.” He said vendor integrations should be treated like privileged accounts, with minimum permissions, continuous monitoring, periodic access reviews, and a tested way to revoke access. “An application you stopped using a year ago may still have permissions in your environment today,” Kadakia added. Wong said accountability is shared. “ConnectWise, as the entry point, is responsible for protecting the credentials and infrastructure that let its app reach across tenants,” he said, adding that customers are responsible for knowing what access they granted, to whom, and for how long. Commoditized attack tooling ARTEX is a Chinese open-source multi-agent LLM system that can use any AI model. Its agents run a penetration test from reconnaissance through data exfiltration with little human interaction. Microsoft said public reporting in October linked the framework to data breaches at Korean financial institutions and that actors across multiple regions are using it. Storm-0940 has been active since 2021, Microsoft said. Its ARTEX-driven targeting spans aerospace and defense, energy, financial services, government, semiconductor and technology, among other sectors. Most of the targeting was unsuccessful, the company said, but the group achieved privileged cloud persistence at many organizations in a short time. “Attacks are being commoditized; threat actors are increasingly turning to open-source tools to launch attacks, meaning the operational sophistication once reserved for well-resourced groups is now available to anyone who can run a GitHub repo against an LLM API,” Wong said. Kadakia said there is no reliable way to tell an AI agent from a human operator by examining individual requests. A legitimate API call made with stolen credentials looks the same regardless of who initiated it, he said. “Defenders should focus on what the identity is doing, not whether a human or AI is controlling it,” he said. Disable ConnectWise connections Microsoft advised customers to keep affected ConnectWise connections disabled until ConnectWise issues restoration instructions and not to delete enterprise applications as a first step. Organizations should search tenants by the four affected application IDs rather than display names and preserve Entra, Purview, and SIEM records, the company said. It also urged a review of activity from at least October 15, extending back to October 1 where records allow. The company also cautioned against treating exposure as proof of a breach. “The presence of an affected application, or even successful authentication, does not necessarily indicate unauthorized data access or data exfiltration,” Microsoft said in the post.