AI Agents Accelerate Supply Chain Breaches

The deployment of autonomous artificial intelligence in cyberattacks has moved from theoretical concern to operational reality, reshaping the timeline of digital breaches.

Microsoft disclosed that a China-state-aligned group known as Storm-0940 utilized ARTEX, an open-source agentic AI penetration testing framework, to execute a large-scale supply chain attack through ConnectWise. By exploiting unauthorized access to this multi-tenant application, the threat actor attempted sign-ins across more than 2,250 Microsoft 365 tenants. The attack relied on stolen ConnectWise application credentials that authenticated without interactive user sign-ins, allowing the system to move at machine speed. In some instances, the group achieved privileged access within three hours of initial targeting, a timeframe that significantly compresses the window for defensive response.

The automation extended to aggressive password spraying, where 327 accounts across eight organizations faced over 151,000 failed logon attempts. At its peak on October 11, the system executed 2,900 attempts per minute, resulting in more than 111,000 failures in a single day. Although nearly 98% of these attempts were locked out, the control of multiple ConnectWise cloud app identities allowed the agents to bypass traditional barriers. Using four specific application credentials, the attackers generated more than 200 sign-ins from a single IP range in under four minutes. This rapid ingress enabled operations such as directory reconnaissance, credential changes, and modifications to privileged roles, all conducted with minimal human interaction.

The targeted industries included aerospace and defense, semiconductor manufacturing, government entities, and think tanks, with 14 sectors listed in total. Microsoft clarified that the breach did not stem from a vulnerability in its own systems but rather from the third-party application. Security firm Huntress observed specific malicious behaviors, such as an application self-assigning a Global Administrator role and planting new secrets set to expire in 2028. By October 16, unauthorized sign-ins were confirmed for 162 tenants, a number that swelled to nearly 1,000 Entra tenants the following day, with over 300 successful logins. The sequential nature of the sweep, occurring seconds apart in sorted order, indicated a script operating from a predefined target list.

The use of ARTEX distinguishes this campaign from traditional methods, as the framework can utilize various AI models to drive autonomous testing. Public reporting this month linked similar technology to breaches at South Korean financial institutions, with suspects allegedly using the framework alongside Anthropic’s Claude Code. In response to the widespread adoption of the tool, the developer of ARTEX announced on GitHub that the project would cease updates and transition to closed source. This development suggests a maturing ecosystem of AI-driven attack tools that threat actors across multiple regions are beginning to integrate into their workflows.

ConnectWise has suspended several services, including Cloud Backup, SaaS Security, and Cloud Management, to contain the issue. A phased restoration process has begun, with recovery expected to take several days. While there are no current indicators that partner backup data was compromised, Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued. The incident underscores the need for organizations to review recent activity logs, as the speed and autonomy of AI agents leave defenders with limited time to detect and respond to intrusions.