AI Agents Fuel Rapid Supply Chain Breach

Autonomous artificial intelligence has turned the tide in a massive digital intrusion that swept through thousands of business networks this month.

Microsoft revealed that a threat group known as Storm-0940 utilized ARTEX, an open-source framework designed for automated penetration testing, to launch a large-scale attack via the ConnectWise platform. This framework operates as a system of large language model-driven agents that conduct security tests with minimal human intervention. By exploiting unauthorized access to this multi-tenant application, the group attempted sign-ins across more than 2,250 different Microsoft 365 tenants. The attack was notably fast, with some breaches reaching privileged access levels in less than three hours after the initial targeting began.

The attackers employed automated password guessing, a technique known as password spraying, against 327 accounts spread across eight organizations. This effort resulted in over 151,000 failed login attempts, though none were successful. The use of the AI-driven agents significantly accelerated the scanning, reconnaissance, and abuse of OAuth applications. These digital workers operate continuously with little need for human direction, creating a pace that leaves security defenders with very little time to detect and respond to the intrusion. It remains unclear exactly how the ConnectWise credentials were stolen or the precise number of tenants that were ultimately compromised.

Storm-0940, a China-state-aligned actor active since 2021, targeted industries including aerospace and defense, semiconductors, government, and think tanks. Microsoft clarified that the attack did not stem from a vulnerability in its own systems or services. At the peak of the password spraying campaign on October 11, the system made 2,900 attempts per minute, totaling over 111,000 for that day. While nearly 98% of this activity was locked out, the attackers used stolen ConnectWise app credentials to sign in to customer tenants from the same IP range, executing more than 200 sign-ins in under four minutes using just four application credentials.

Within some affected tenants, the AI agents performed directory operations, reconnaissance, and changes to app credentials and privileged roles. On October 15, security firm Huntress observed an application adding itself to the top administrator role, a behavior that triggered a specific Microsoft Defender alert. This action included planting new secrets set to expire in 2028. By October 16, Huntress confirmed unauthorized sign-ins for 162 tenants, and by the following day, almost 1,000 tenants showed sign-in activity from the attacking IP, with more than 300 of those succeeding. The sequential nature of the attacks suggested a script working from a predefined target list.

This incident marks a shift in traditional attack methods due to the use of an open-source pentest framework that can utilize various AI models. Public reports have linked similar technology to breaches at South Korean financial institutions, where the suspect allegedly used ARTEX with Anthropic’s Claude Code. The developer of ARTEX, identified by the handle Autumn-27, announced that the project would no longer be updated and would become closed source. In response, ConnectWise suspended several services, including Cloud Backup, as a precaution. The company has begun a phased restoration process, with recovery expected to take several days, and currently sees no indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review recent activity logs where possible.