Hackers Use AI Agents to Target Over 2,250 Microsoft 365 Tenants Through ConnectWise

Hackers used AI agents and stolen ConnectWise application credentials to attempt access to more than 2,250 Microsoft 365 tenants, according to Microsoft’s technical investigation report.

Microsoft attributed the campaign to Storm-0940, a China-state-aligned group, and said its ARTEX framework accelerated reconnaissance, authentication attempts, and cloud persistence. The targeting count does not mean every tenant was breached.

The attack exploited permissions customers had already granted to trusted ConnectWise applications. Earlier reporting on compromised ConnectWise backup credentials documented unauthorized sign-ins across 173 partner and customer tenants.

Attackers authenticated as applications rather than users, avoiding interactive password entry and ordinary user MFA prompts without breaking Microsoft’s authentication system.

Researchers from Huntress identified the credential abuse and examined its behavior in an October 26 technical analysis.

Their findings support Microsoft’s account but do not independently prove AI involvement. Importantly, the report describes malicious application activity and attack tooling, not a newly identified malware family.

Hackers Use AI Agents

ARTEX is a penetration-testing framework that coordinates multiple AI agents. Microsoft says it can automate tasks from reconnaissance through data exfiltration while building a connected map of discovered assets and weaknesses.

In this campaign, stolen application credentials provided access through existing customer trust, rather than a newly disclosed Microsoft vulnerability.

Huntress observed most activity on October 15 within a window shorter than 14 hours. One automated sweep processed almost 1,000 tenants in ascending identifier order.

Separate bursts sent about 100 failed token requests within 10 seconds, showing parallel workers operating without waiting to evaluate each response.

The more revealing evidence involved changes between runs. After a certificate upload failed because its thumbprint did not match, another run began 55 seconds later with retry logic.

It retried after approximately 3.5 and 7.1 seconds, then carried the revised approach into another tenant. These observations add detail to earlier coverage of ARTEX attacks against tenants, particularly how tooling adapted after errors.

Huntress saw secrets added, removed, and restored, alongside privileged role changes. A Teams application identity assigned itself Global Administrator, demonstrating how trusted application access could become administrative control.

However, automation was not consistently responsive. After a Teams service principal was deleted, requests continued every four to eight seconds for another 22 minutes. That behavior could reflect unattended scripts or background tasks within a multi-agent system. Huntress therefore rates AI involvement at low-to-medium confidence from its own telemetry, rising to medium-to-high when considering Microsoft’s attribution.

Detection Gaps and Microsoft 365 Protection

Missing Microsoft Graph activity logs limit what investigators can establish. Entra audit records do not capture Graph reads, and Huntress knew of no victim with Graph activity logging enabled.

Successful authentication therefore cannot establish what information was read or stolen. Microsoft also distinguishes targeting, successful sign-ins, and confirmed data access.

Its earlier password-spray investigation recorded more than 151,000 failed logons against 327 accounts across eight organizations, peaking at 2,900 failures per minute. That rate belongs to the password-spray phase, not a verified count of successful ConnectWise logins.

The investigation reinforces concerns around AI agents as threats, but defenders should prioritize harmful actions over assumptions about AI.

Huntress recommends alerts for applications assigning themselves powerful roles, unexpected credential additions, and vendor identities behaving outside their normal patterns. Cross-tenant monitoring can reveal campaigns that appear minor inside individual environments.

Microsoft advises keeping affected connections disabled until formal restoration guidance arrives, preserving evidence before deleting applications, and reviewing credentials, permissions, and role assignments.

Removing the original access route may leave credentials planted elsewhere. Teams should enable Graph logging where available and investigate suspicious mailbox or file activity alongside identity changes.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Use AI Agents to Target Over 2,250 Microsoft 365 Tenants Through ConnectWise appeared first on Cyber Security News.