Microsoft Warns of AI-Assisted Cyberattacks Targeting More Than 2,250 Cloud Tenants
Microsoft has warned that Storm-0940, a hacking group it links to China, used an artificial intelligence-powered penetration-testing framework to accelerate cyberattacks against organisations worldwide. The campaign targeted hundreds of organisations across multiple industries and attempted to access more than 2,250 cloud tenants, according to Microsoft's security researchers.
The operation involved ConnectWise, an IT services provider, and raised concerns about software supply-chain security. Microsoft said the attackers used an open-source framework called ARTEX to automate reconnaissance, password-spraying attempts and the misuse of application credentials. Although most targeting attempts were unsuccessful, investigators identified evidence of privileged access and follow-on activity in multiple customer environments.
What Is Storm-0940?
Storm-0940 is a cyber threat actor that Microsoft has tracked since at least 2021. The group has historically targeted organisations for data theft, using techniques such as password spraying, exploiting internet-facing applications and misusing compromised credentials.
Password spraying involves trying a small number of commonly used or previously obtained passwords against many accounts. Attackers use this method to seek access while attempting to avoid security controls that detect repeated failed logins against a single account.
After gaining initial access, attackers may attempt to move through an organisation's network, access sensitive information or establish a way to return to the compromised environment. In cloud systems, this can involve abusing application identities and changing credentials or permissions.
Microsoft assesses that Storm-0940 used these established techniques alongside AI-driven automation to increase the speed and scale of its operations.
How Did Artificial Intelligence Help the Attackers?
The campaign used ARTEX, an open-source penetration-testing framework that can work with different AI models. Penetration testing is normally a legitimate security practice in which authorised specialists examine systems for weaknesses. However, tools designed for security testing can be misused when operated by unauthorised individuals.
ARTEX uses multiple AI-driven agents to automate tasks across a penetration-testing workflow. These tasks can include identifying targets, scanning systems, conducting reconnaissance and attempting to access information.
Microsoft reported that Storm-0940 used ARTEX to accelerate its activities against cloud environments. The automated system could perform several tasks in parallel and operate continuously, reducing the time between selecting a target and attempting to gain access.
In some cases, Microsoft observed the group reaching privileged cloud access in less than three hours from initial targeting. This speed can make it more difficult for security teams to investigate alerts, determine the extent of an intrusion and remove unauthorised access before further activity occurs.
The incident demonstrates that AI does not need to create an entirely new type of cyberattack to increase risk. Automating established techniques can make existing threats faster, more scalable and harder to manage.
Why Was ConnectWise Targeted?
ConnectWise provides technology and IT management services to businesses. Its Cloud Backup environment became a central part of the incident after unauthorised access was identified.
Microsoft assessed that Storm-0940 was responsible for the ConnectWise supply-chain compromise. In a supply-chain attack, an attacker targets a trusted service provider, application or supplier to reach other organisations that depend on it.
This approach can be particularly dangerous when a third-party application has permission to access customer cloud accounts. If attackers compromise the application's credentials, they may be able to use the existing trust relationship to access connected environments without requiring a conventional interactive sign-in from a user.
Following the compromise, the attackers used ARTEX to attempt sign-ins to more than 2,250 tenants at a rate of approximately 2,900 sign-in attempts per minute, according to Microsoft.
Microsoft also reported that the broader password-spraying campaign between October 10 and 14 generated more than 151,000 failed sign-in events across 327 accounts at eight organisations. The high volume of attempts highlighted how automation can place pressure on security monitoring and incident-response teams.
What Information Could Attackers Access?
Microsoft observed suspicious activity in multiple customer environments, including reconnaissance, application credential changes and attempts to modify permissions. Such actions can help attackers maintain access or expand their control over cloud resources.
However, the company cautioned that the presence of an affected application or a successful authentication does not automatically prove that customer data was accessed or stolen. Each organisation must investigate its own records to determine whether unauthorised activity occurred.
Microsoft advised affected customers to examine application sign-in records, audit logs and changes involving credentials, user accounts, groups and privileged roles. Organisations should also investigate unusual access to email, files and other cloud resources.
ConnectWise said it had contained affected application connections and was restoring services in controlled phases. The company advised customers to follow its formal restoration instructions and review their individual environments for signs of unauthorised access.
Which Industries Were Targeted?
According to Microsoft, the campaign affected a broad range of sectors. These included aerospace, defence, automotive, chemicals, energy, financial services, government, legal services, manufacturing, media, military, semiconductors, software, technology, think tanks and non-profit organisations.
The diversity of targets suggests that organisations should not assume they are outside the scope of modern cyber threats simply because they operate in a particular industry. Companies of different sizes may depend on the same cloud platforms, software suppliers and identity systems.
The incident also reinforces the importance of assessing third-party applications according to the access they have been granted. A trusted application with excessive permissions can become a route into other systems if its credentials are compromised.
How Can Organisations Protect Themselves?
Microsoft recommended that organisations using affected ConnectWise integrations keep the relevant connections disabled until formal restoration instructions are provided. Security teams should preserve logs and other evidence before making changes that could interfere with an investigation.
Organisations should review application permissions, remove unauthorised credentials and rotate secrets when compromise is confirmed or suspected. They should also monitor unusual sign-in activity, unexpected changes to administrative roles and suspicious application access.
The principle of least privilege is particularly important. Applications and users should receive only the permissions required for their work. Multifactor authentication, strong identity controls, timely software updates and continuous monitoring can further reduce the risk of unauthorised access.
Businesses should also maintain an incident-response plan that includes third-party suppliers and cloud services. Regular security reviews can help identify excessive permissions and outdated integrations before attackers exploit them.
Conclusion
The Storm-0940 campaign highlights the growing role of AI in cyber operations and the risks associated with trusted software providers. By automating reconnaissance and credential-based attacks, threat actors can attempt to reach large numbers of cloud environments in a short period.
Microsoft said most targeting attempts were unsuccessful, but the reported access in multiple environments shows why organisations must respond quickly to suspicious activity. Reviewing application permissions, protecting credentials and investigating cloud audit records are essential steps in limiting the impact of supply-chain attacks.
The incident is a reminder that cybersecurity depends not only on protecting individual accounts but also on securing the applications and service providers connected to them.
