AI Agents Accelerate Massive Supply Chain Breach

The integration of autonomous artificial intelligence into cyber operations has created a significant gap between the speed of attack and the capacity for defense. In a recent large-scale campaign, a China-state-aligned group known as Storm-0940 leveraged ARTEX, an open-source agentic AI penetration testing framework, to execute a supply chain attack via ConnectWise. The operation resulted in attempted sign-ins across more than 2,250 Microsoft 365 tenants, with certain attacks achieving privileged access in less than three hours after initial targeting.

Microsoft’s security team detailed how the group exploited unauthorized access to the multi-tenant application. By using stolen ConnectWise app credentials, the attackers authenticated as the applications themselves, bypassing the need for interactive user sign-ins. This method allowed the AI agents to operate around the clock with minimal human intervention, accelerating phases such as scanning, reconnaissance, and OAuth application abuse to a pace that left defenders with little time to react.

The campaign also featured extensive automated password guessing, or password spraying, which targeted 327 accounts across eight organizations. This phase generated over 151,000 failed logon attempts without achieving any successes. At its peak on October 11, the password spray registered 2,900 attempts per minute, totaling more than 111,000 for the day. While almost 98 percent of this activity resulted in lockouts, the use of application credentials allowed the agents to sign into customer tenants from the same IP range, recording over 200 sign-ins in under four minutes using just four application credentials.

Storm-0940, an active threat since 2021, targeted industries including aerospace, defense, semiconductors, government, and think tanks. Microsoft clarified that the activity did not stem from a vulnerability in its own systems or products. Instead, the breach relied on the compromise of ConnectWise identities. Within affected tenants, the attackers performed directory operations, changed app credentials, and modified privileged roles, indicating a thorough effort to establish persistent access.

Security firm Huntress observed specific malicious behavior on October 15, where an application added itself to the top administrator role. This action triggered a specific alert in Microsoft Defender regarding self-assigned Global Administrator roles. The attackers also planted new secrets set to expire in 2028. By October 16, Huntress had confirmed unauthorized sign-ins for 162 tenants, a number that rose to nearly 1,000 Entra tenants by the following day, with more than 300 sign-ins succeeding from the attacking IP range.

The systematic nature of the attack was evident in the sequential sweep through tenants, occurring just seconds apart, which suggested a script operating from a predefined target list. This incident is part of a broader trend where threat actors in various regions are adopting ARTEX, a framework capable of utilizing any AI model. Public reporting this month also linked the tool to breaches at South Korean financial institutions, where the suspect allegedly used ARTEX with Anthropic’s Claude Code.

In response to the shifting threat landscape, the developer of ARTEX, known by the handle “Autumn-27,” announced on GitHub that the project would become closed source and would no longer receive updates. ConnectWise has suspended several services, including Cloud Backup and SaaS Security, as a precaution. A phased restoration process has begun, with recovery expected to take several days. Currently, there are no indicators that partner backup data was compromised, though Microsoft advises customers to keep affected app connections disabled and review recent logs until formal restoration instructions are issued.

As the incident unfolds, the primary concern for organizations remains the potential for data exfiltration, although Microsoft notes that a successful sign-in does not guarantee data access. The rapid evolution of these AI-driven tools suggests that traditional defense timelines may need to be compressed further to match the autonomous pace of modern cyber threats.