AI Agents Speed Up Massive Supply Chain Breach

The traditional timeline for a cyberattack to reach critical systems is collapsing. In a significant shift for enterprise security, a China-state-aligned hacking group known as Storm-0940 utilized autonomous artificial intelligence agents to breach more than 2,250 Microsoft 365 tenants. The attack leveraged stolen credentials from ConnectWise, a multi-tenant application, allowing the attackers to authenticate without interactive user sign-ins. For some organizations, the distance between initial targeting and privileged access was less than three hours, a speed that leaves defenders with minimal time to react.

Microsoft identified the tool behind this rapid escalation as ARTEX, an open-source framework for agentic AI penetration testing. This system employs large language model-driven agents to conduct autonomous scans, reconnaissance, and password spraying. By operating continuously with little human intervention, these agents accelerated the pace of the attack significantly. The framework’s efficiency meant that automated password guessing targeted 327 accounts across eight organizations, generating over 151,000 failed logon attempts with no successes.

The sophistication of the operation was evident in the volume of traffic. At its peak on October 11, the password spray campaign executed 2,900 attempts per minute, resulting in more than 111,000 failures that day. Although nearly 98% of these attempts were locked out, the attackers maintained control through ConnectWise cloud app identities. From a single IP range, the AI agents used four application credentials to execute over 200 sign-ins in under four minutes. This automated sweep moved through tenants in sorted order, a pattern indicating a script working from a predefined target list.

The targets were high-value sectors, including aerospace and defense, semiconductor manufacturing, government agencies, and think tanks, with 14 industries listed in total. Microsoft clarified that the attack did not stem from a vulnerability in its own systems but rather from the compromise of third-party application credentials. The exact method of credential theft remains unclear, as does the total number of tenants that suffered actual data compromise.

Security firm Huntress provided on-the-ground observations, noting that in one tenant on October 15, an application added itself to the top administrator role. This behavior triggered specific Microsoft Defender alerts and involved planting new secrets set to expire in 2028. By October 16, Huntress confirmed unauthorized sign-ins for 162 tenants. The following day, that number grew to almost 1,000 Entra tenants showing activity from the attacking IP, with more than 300 successful logins.

This incident highlights a broader trend where threat actors in multiple regions are adopting ARTEX. Public reporting this month linked the framework to breaches at South Korean financial institutions, with CrowdStrike suggesting the suspect used Anthropic’s Claude Code alongside ARTEX. In response to the growing adoption, the developer of ARTEX, who goes by the handle Autumn-27, announced on GitHub that the project would become closed source and cease updates, a move reported by Reuters.

ConnectWise responded by suspending its Cloud Backup, SaaS Security, and Cloud Management services as a precaution. The company has begun a phased restoration process, with recovery expected to take several days. While there are currently no indicators that partner backup data was compromised, Microsoft advises customers to keep affected app connections disabled until formal instructions are issued. The event underscores the urgent need for organizations to review recent activity logs, as the use of AI agents is fundamentally changing the speed and scale of supply chain attacks.