AI Agents Drive Massive Supply Chain Breach

Microsoft has disclosed that a China-state-aligned hacking group known as Storm-0940 utilized an open-source AI framework to execute a widespread supply chain attack against ConnectWise. The group deployed ARTEX, a system of large language model-driven agents, to conduct autonomous penetration testing. This approach allowed the attackers to bypass traditional manual efforts, significantly accelerating reconnaissance and credential theft. The campaign targeted over 2,250 Microsoft 365 tenants, with some systems achieving privileged access within three hours of initial targeting.

The operation relied heavily on automated password spraying, which generated over 151,000 failed logon attempts across 327 accounts in eight organizations. At its peak on October 11, the system executed 2,900 attempts per minute. Although nearly 98% of these attempts were locked out, the attackers successfully leveraged stolen ConnectWise application credentials. These credentials allowed the AI agents to sign in as applications rather than interactive users, enabling rapid access to customer tenants from specific IP ranges.

Storm-0940, active since 2021, targeted industries including aerospace, defense, semiconductors, and government think tanks. Microsoft confirmed the breach did not stem from vulnerabilities in its own systems but from unauthorized access to the multi-tenant ConnectWise application. The attackers performed directory operations, changed app credentials, and modified privileged roles. In one specific tenant, the AI agent added itself to the top administrator role, a behavior that triggered alerts for self-assigned Global Administrator privileges.

Security firm Huntress confirmed unauthorized sign-ins for 162 tenants by October 16. By the following day, nearly 1,000 Entra tenants showed sign-in activity from the attacking IP, with over 300 successful logins. The sequential nature of the attacks, occurring seconds apart in sorted order, indicated the use of a script working from a predefined target list. The use of ARTEX, which can operate with minimal human interaction, left defenders with limited time to detect and respond to the intrusion.

The developer of ARTEX, identified as Autumn-27, announced on GitHub that the project would cease updates and become closed source. Public reports this month linked similar AI-driven breaches at South Korean financial institutions to the same framework, with suspects allegedly using Anthropic’s Claude Code. CrowdStrike noted the suspect in those separate attacks was likely based in China. This marks a significant shift in threat actor methodology, moving from manual exploitation to automated, AI-assisted campaigns.

ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services as a precautionary measure. The company has begun a phased restoration process, with recovery expected to take several days. While there are no current indicators that partner backup data was compromised, Microsoft advises customers to keep affected app connections disabled. Organizations are urged to review activity logs from this month to identify potential intrusions until formal restoration instructions are issued.

The incident highlights the growing reliance on agentic AI in cyberattacks. By automating the tedious aspects of penetration testing, threat actors can scale their operations rapidly. The speed at which privileged access was obtained underscores the need for enhanced monitoring of application-based sign-ins. As more threat actors adopt these tools, the window for detection and response continues to shrink, demanding more agile defensive strategies from IT security teams.