AI Agents Accelerate Supply Chain Breach

Microsoft disclosed on Wednesday that a China-state-aligned hacking group utilized an open-source artificial intelligence framework to execute a widespread supply chain attack. The incident, attributed to the actor known as Storm-0940, involved the deployment of autonomous agents to probe over 2,250 Microsoft 365 tenants. The group used compromised credentials from ConnectWise, a multi-tenant application, to authenticate as software apps rather than interactive users, allowing them to bypass standard sign-in checks.

The operation demonstrated unprecedented speed in gaining high-level access. According to the security firm’s findings, some of the automated attacks achieved privileged access in less than three hours after initial targeting. The group employed ARTEX, a system of large language model-driven agents, to automate reconnaissance, scanning, and password spraying. This technology enabled the attackers to work continuously with minimal human intervention, significantly compressing the window of time available for defenders to detect and react to the intrusion.

The campaign included a massive password spraying effort that targeted 327 accounts across eight organizations. These attempts resulted in more than 151,000 failed logons, though no successful password guesses were recorded during this specific phase. The automation allowed the agents to perform these actions at a pace that traditional manual attacks could not match. It remains uncertain how the initial ConnectWise credentials were stolen or the exact number of tenants ultimately compromised by the group.

Storm-0940, which has been active since 2021, is described as having no known industry aliases and follows naming conventions for developing actors. The attack targeted 14 industries, including aerospace and defense, semiconductors, government, and think tanks. Microsoft clarified that the breach did not stem from a vulnerability in its own systems or products, but rather from the compromise of the ConnectWise application identities. The group used these identities to sign in to customer tenants from the same IP range.

At its peak on Oct. 11, the password spraying activity reached 2,900 attempts per minute, with over 111,000 failures recorded that day. Nearly 98% of this activity resulted in account lockouts. However, the attackers leveraged the stolen ConnectWise app credentials to execute more than 200 sign-ins in under four minutes using just four application credentials. Within affected tenants, the agents performed directory operations, reconnaissance, and changes to app credentials, identities, groups, and privileged roles.

Security firm Huntress observed specific behaviors in one tenant on Oct. 15, where an app added itself to the top administrator role. This action triggered a Microsoft Defender alert regarding self-assigned Global Administrator roles. The attackers also planted new secrets configured to expire in 2028. By Oct. 16, Huntress confirmed unauthorized sign-ins for 162 tenants. The following day, nearly 1,000 Entra tenants showed sign-in activity from the attacking IP, with over 300 of those sign-ins succeeding. The systematic, sorted order of the tenant sweep suggested the use of a script working from a target list.

The use of ARTEX marks a shift from traditional attack methods. The framework, developed by a user known as Autumn-27, can utilize various AI models. Recent public reporting linked similar ARTEX usage to breaches at South Korean financial institutions, with CrowdStrike noting the suspect was likely based in China and used Anthropic’s Claude Code. The developer has since stated that the ARTEX project will no longer be updated and will become closed source. ConnectWise has suspended several services as a precaution and begun a phased restoration, with no current indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review recent activity logs where possible.