AI Agents Push Rapid Access In Supply Chain Breach

Cyber attackers aligned with the Chinese state have deployed artificial intelligence to breach thousands of Microsoft 365 tenants in a supply chain attack targeting ConnectWise. Microsoft reported that the group, designated Storm-0940, utilized ARTEX, an open-source agentic AI penetration testing framework, to accelerate its operations. This tool enabled the creation of LLM-driven agents capable of conducting autonomous penetration tests with minimal human supervision, operating around the clock to scan networks and guess passwords. The speed of the assault left defenders with very little time to detect and respond to the intrusion.

The attack, which began with unauthorized access to a multi-tenant application, resulted in attempted sign-ins across more than 2,250 Microsoft 365 tenants. The group used stolen credentials associated with ConnectWise applications, allowing the software to authenticate itself without requiring an interactive sign-in from a user. In some instances, the attackers achieved privileged access less than three hours after the initial targeting began. Microsoft stated that this activity did not result from a compromise or vulnerability within its own systems, products, or services. The specific method used to steal the ConnectWise credentials, as well as the total number of tenants successfully compromised, remains unknown.

Automated password spraying campaigns were also launched as part of the operation. A total of 327 accounts across eight organizations were targeted, generating more than 151,000 failed logon attempts. None of these password guessing attempts were successful. At the height of this activity on Oct. 11, the rate reached 2,900 attempts per minute, all of which failed, totaling more than 111,000 failures for that day. Forty-eight accounts recorded more than 1,000 failures each, and almost 98% of this activity was locked out. However, by controlling the identities of multiple ConnectWise cloud apps, the attacking AI agents signed into customer tenants from the same IP range using those app credentials. More than 200 sign-ins occurred in under four minutes using four application credentials.

Operations conducted within some tenants included Graph and directory operations, reconnaissance, and changes to identities, groups, and privileged roles. On Oct. 15, security firm Huntress observed an application add itself to the top administrator role in one tenant, triggering a Microsoft Defender alert. This action involved planting new secrets set to expire in 2028. By Oct. 16, Huntress confirmed unauthorized sign-ins for 162 tenants. A day later, almost 1,000 Entra tenants showed sign-in activity from the attacking IP, with more than 300 succeeding. The attack's sweep through tenants in sorted order, a few seconds apart, indicated a script working from a target list.

Storm-0940, active since 2021, is identified by Microsoft as a China-state-aligned actor with no known industry aliases. The name follows the convention for a developing actor. Industries targeted in this campaign include aerospace and defense, semiconductor, government, and think tanks, with 14 listed in total. The use of the open-source penetration testing framework distinguishes this event from many traditional attacks. Microsoft notes that the tool can utilize any AI model, and threat actors in multiple regions are using the technology. Public reporting this month tied it to breaches at South Korean financial institutions. CrowdStrike said the suspect in those separate attacks was likely based in China and allegedly used ARTEX with Anthropic's Claude Code. The developer of ARTEX, who uses the handle Autumn-27, stated on GitHub that the project will no longer be updated and would become closed source.

ConnectWise noted the unauthorized access and suspended Cloud Backup, formerly SkyKick, as well as SaaS Security and Cloud Management as a precaution. It has started a phased restoration with recovery expected to take several days. The company has no indicators to date that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued. Customers are also advised to review activity from this month where logs allow. An affected app, or even a successful sign-in, does not necessarily mean data was accessed or taken.

The timeline of the incident began with unauthorized access to a multi-tenant application, followed by the deployment of stolen credentials to attempt sign-ins across thousands of tenants. On Oct. 11, a password spray campaign reached its peak rate of 2,900 attempts per minute. By Oct. 15, security firms observed unauthorized attempts to assign global administrator roles. By Oct. 17, unauthorized sign-in activity was confirmed across almost 1,000 Entra tenants. The attack's reliance on autonomous agents highlights the increasing speed of cyber operations.

What comes next involves the restoration of suspended services and the review of logs by affected customers. ConnectWise is proceeding with a phased restoration that is expected to take several days. Microsoft advises keeping affected app connections disabled until formal restoration instructions are issued. The company also recommends reviewing activity from this month where logs allow. The speed of the attack, with some reaching privileged access in under three hours, leaves defenders with little time to detect and respond.