AI Agents Drive Massive Supply Chain Breach

Microsoft disclosed that a China-state-aligned threat group named Storm-0940 leveraged an open-source agentic AI framework to execute a significant supply chain attack through ConnectWise. By exploiting unauthorized access to this multi-tenant application, the attackers attempted sign-ins across more than 2,250 Microsoft 365 tenants. The operation utilized stolen application credentials, allowing the system to authenticate as the apps without requiring interactive user logins. In several instances, the intrusion reached privileged access levels less than three hours after the initial targeting began.

The attackers employed automated password spraying techniques against 327 accounts spanning eight organizations. This resulted in over 151,000 failed logon attempts, though none succeeded. The deployment of ARTEX, a system of large language model-driven agents, accelerated scanning, reconnaissance, and OAuth application abuse. These agents operated autonomously with minimal human interaction, a pace that left defenders with limited time to detect and respond. It remains unclear how the initial ConnectWise credentials were stolen or the exact number of tenants that were fully compromised.

Storm-0940, which has been active since 2021, targeted industries including aerospace, defense, semiconductor, government, and think tanks. Fourteen specific industries were listed in the report. Microsoft clarified that the activity did not stem from a vulnerability or compromise within its own systems or products. At its peak on October 11, the password spraying campaign reached 2,900 failed attempts per minute. Over 111,000 attempts occurred that day, with 48 accounts logging more than 1,000 failures each. Nearly 98 percent of this activity resulted in lockouts.

Despite the lockouts, the AI agents signed into customer tenants from the same IP range using the compromised app credentials. They recorded more than 200 sign-ins in under four minutes using just four application credentials. Within these tenants, the agents performed directory operations, reconnaissance, and changes to app credentials, identities, and privileged roles. On October 15, Huntress, a security firm, observed an app adding itself to the top administrator role in one tenant. This behavior triggered a Microsoft Defender alert regarding the application self-assigning a Global Administrator role. The attackers also planted new secrets set to expire in 2028.

Huntress confirmed unauthorized sign-ins for 162 tenants by October 16. By the following day, almost 1,000 Entra tenants showed sign-in activity from the attacking IP, with more than 300 succeeding. The sequential nature of the sweep, occurring seconds apart, suggested a script working from a target list. The use of ARTEX differs from traditional attacks because the framework can utilize any AI model. Public reporting this month linked similar tools to breaches at South Korean financial institutions. CrowdStrike noted that the suspect in those separate attacks was likely based in China and allegedly used ARTEX with Anthropic’s Claude Code. The developer of ARTEX, known as Autumn-27, announced on GitHub that the project would no longer be updated and would become closed source.

ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services as a precaution after noting the unauthorized access. The company has begun a phased restoration process, with recovery expected to take several days. There are currently no indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued. It also recommends reviewing activity from this month where logs are available, noting that a successful sign-in does not necessarily mean data was accessed or exfiltrated.