2,250 Tenants Breached: AI Agents Drive High-Speed Supply Chain Attack
A China-aligned threat group leveraged autonomous AI tools to compromise enterprise infrastructure, achieving privileged access in some cases within three hours.
By Christopher Reed ·
The deployment of autonomous artificial intelligence agents has significantly accelerated the timeline for major cyber intrusions, with some attackers securing high-level privileges in under three hours.
This rapid escalation was identified in a large-scale supply chain attack orchestrated by a China-state-aligned group known as Storm-0940. The operation targeted the ConnectWise platform, allowing the threat actors to exploit stolen application credentials. Microsoft’s security team confirmed that the group utilized ARTEX, an open-source framework designed for agentic penetration testing, to streamline the attack. By authenticating as legitimate applications rather than interactive users, the attackers bypassed traditional sign-in barriers, attempting access to more than 2,250 Microsoft 365 tenants.
The timeline of the intrusion highlights a shift toward automated persistence. The group, active since 2021, targeted 14 distinct industries, including aerospace, defense, semiconductors, government, and think tanks. Microsoft clarified that the breach did not stem from a vulnerability in its own systems but from the compromised third-party application. The use of LLM-driven agents allowed for continuous scanning and reconnaissance with minimal human oversight, a pace that leaves defenders with limited time to react. In parallel, automated password spraying campaigns targeted 327 accounts across eight organizations, generating over 151,000 failed logons without a single success.
The operational intensity peaked on October 11, when the password spray mechanism executed 2,900 attempts per minute, totaling more than 111,000 failures for the day. While nearly 98% of these attempts were locked out, the group’s control over multiple ConnectWise cloud app identities proved more effective. From a single IP range, the agents executed over 200 sign-ins in less than four minutes using just four application credentials. Once inside, the actors performed directory operations, modified app credentials, and adjusted privileged roles, indicating a sophisticated understanding of the target environment.
External security firm Huntress observed specific behaviors on October 15, such as an application self-assigning a Global Administrator role. The attackers also planted new secrets configured to expire in 2028, suggesting an intent for long-term access. By October 16, Huntress had confirmed unauthorized sign-ins for 162 tenants. The following day, that number surged to nearly 1,000 Entra tenants with sign-in activity from the attacking IP, with more than 300 sign-ins succeeding. The systematic, sorted-order sweep of tenants suggested the use of a script working from a predefined target list.
The technical implications of this event are significant for the market. The attack utilized ARTEX, a framework that can integrate various AI models, marking a departure from traditional manual exploitation. Public reports this month have linked similar ARTEX-based techniques to breaches at South Korean financial institutions. CrowdStrike indicated that the suspect in those separate incidents was likely based in China and used the framework alongside Anthropic’s Claude Code. In response to the widespread use, the ARTEX developer, known as Autumn-27, announced on GitHub that the project would cease updates and transition to a closed-source model.
ConnectWise has suspended several of its services, including Cloud Backup, SaaS Security, and Cloud Management, as a precautionary measure. A phased restoration process has begun, with recovery expected to take several days. To date, there are no indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review activity logs from this month where possible. The incident underscores the growing financial and operational risks associated with AI-driven threat actors in the enterprise sector.
As the restoration process unfolds, organizations are advised to monitor their Entra tenants closely. The speed at which these AI agents operated highlights the need for faster detection mechanisms. The incident serves as a case study in how open-source AI tools are reshaping the threat landscape, forcing businesses to rethink their security perimeters and response times.
Source: Tom's Hardware
