AI-Driven Hackers Breach 2,250 Firms in Hours, Exposing Speed Gap for Defenders

For many businesses in New England and across the region, the immediate reality is a potential disruption to backup services and a heightened sense of urgency regarding cloud security. A recent large-scale cyberattack, which targeted over 2,250 Microsoft 365 tenants, has forced organizations to reassess how quickly they can detect and respond to automated threats. The incident highlights a shifting dynamic in digital defense, where the pace of attack is increasingly determined by artificial intelligence rather than human speed.

According to Microsoft, the actor responsible, identified as Storm-0940, leveraged ARTEX, an open-source framework for agentic AI penetration testing, to execute this supply chain attack. The group gained unauthorized access to a multi-tenant application called ConnectWise. Using stolen credentials from this application, the attackers authenticated as the app itself, bypassing the need for interactive user sign-ins. This method allowed them to move through systems with a level of automation that traditional manual attacks rarely achieve.

The speed of the operation is the most striking aspect for defenders. In several cases, the attack team reached privileged access levels less than three hours after initially targeting a specific tenant. By October 11, the peak of the campaign saw the automated system attempt nearly 2,900 sign-ins per minute. While 111,000 attempts were made that day, the vast majority failed. However, the sheer volume of activity, with 48 accounts logging over 1,000 failures each, suggests a relentless, script-driven approach that swept through tenants in sorted order, often just seconds apart.

Beyond simple brute-force logins, the attackers employed automated password spraying against 327 accounts across eight organizations. This resulted in over 151,000 failed logons with no successful entries, indicating that the primary vector was not guessing passwords but abusing application identities. The use of LLM-driven agents within the ARTEX framework accelerated reconnaissance, scanning, and OAuth application abuse, operating around the clock with minimal human intervention.

Storm-0940, active since 2021, is described as a China-state-aligned actor with no known industry aliases. The campaign targeted 14 industries, including aerospace, defense, semiconductors, government, and think tanks. Microsoft clarified that the breach did not stem from a vulnerability in its own systems or products, but rather from the compromise of a third-party application. This distinction is crucial for understanding the supply chain risk that organizations face when integrating external tools into their Microsoft environments.

Security firm Huntress provided further details on the actions taken within compromised tenants. On October 15, an application added itself to the top administrator role, a behavior that triggered specific alerts in Microsoft Defender. The attackers also planted new secrets set to expire in 2028, suggesting a long-term presence. By October 16, Huntress had confirmed unauthorized sign-ins for 162 tenants, and by the next day, nearly 1,000 tenants showed sign-in activity from the attacking IP, with over 300 succeeding.

The attack has prompted immediate action from ConnectWise, which suspended its Cloud Backup, SaaS Security, and Cloud Management services as a precaution. The company has begun a phased restoration, expecting recovery to take several days, and currently reports no indicators that partner backup data was compromised. However, the uncertainty remains regarding exactly how the ConnectWise credentials were stolen and how many tenants suffered actual data exfiltration versus mere access.

This incident is part of a broader trend, as public reporting this month has linked similar ARTEX-based breaches to South Korean financial institutions. The developer of ARTEX has announced the project will no longer be updated and will become closed source, potentially changing the landscape for future attacks. For now, Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review activity logs from this month to assess exposure.