AI Agents Fuel Rapid Supply Chain Strike Against Microsoft Tenants

Microsoft has confirmed that a China-aligned hacking group used artificial intelligence agents to execute a massive supply chain attack. The operation targeted the ConnectWise platform, allowing attackers to attempt sign-ins at more than 2,250 Microsoft 365 tenants. In some cases, the group gained privileged access to systems in under three hours.

The attacker, identified as Storm-0940, utilized ARTEX, an open-source framework designed for autonomous penetration testing. This system employs large language model agents to conduct reconnaissance, scanning, and password spraying with minimal human oversight. Microsoft noted that this technology allows attacks to proceed around the clock, leaving defenders with very little time to react.

The breach began with unauthorized access to the multi-tenant ConnectWise application. Attackers used stolen application credentials to authenticate without interactive user sign-ins. They also launched automated password spraying campaigns against 327 accounts across eight organizations. These efforts resulted in more than 151,000 failed logons, though none were initially successful.

On October 11, the password spraying activity peaked with 2,900 attempts per minute. Over 111,000 failures were recorded that day, with 48 accounts experiencing more than 1,000 failures each. Nearly 98% of this activity resulted in account lockouts. However, the AI agents leveraged control of multiple ConnectWise cloud apps to sign in to customer tenants from the same IP range.

The speed of the operation was notable. Using four application credentials, the agents executed more than 200 sign-ins in under four minutes. Within affected tenants, the group performed directory operations, reconnaissance, and changes to app credentials, identities, and privileged roles. The systematic nature of the sweep, with sign-ins occurring seconds apart, suggested the use of a script working from a target list.

Security firm Huntress observed specific behaviors in one tenant on October 15. An application added itself to the top administrator role, triggering a Microsoft Defender alert. The attackers also planted new secrets set to expire in 2028. By October 16, Huntress confirmed unauthorized sign-ins for 162 tenants. A day later, that number rose to nearly 1,000 Entra tenants, with over 300 sign-ins succeeding.

Storm-0940 has been active since 2021 and is described as having no known industry aliases. The group targeted 14 industries, including aerospace, defense, semiconductor, government, and think tanks. Microsoft clarified that the attack did not stem from a vulnerability in its own systems or products. The use of ARTEX is part of a broader trend, with recent reports linking the framework to breaches at South Korean financial institutions.

In response, ConnectWise suspended several services, including Cloud Backup, SaaS Security, and Cloud Management. The company has begun a phased restoration process, expecting recovery to take several days. There are currently no indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review recent activity logs where possible.

The developer of ARTEX, who uses the handle Autumn-27, announced on GitHub that the project will no longer be updated and will become closed source. This move comes as threat actors in multiple regions continue to adopt the technology. The incident highlights the growing speed and scale of attacks driven by autonomous AI agents in the supply chain.