AI Agents Drive Record-Breaking Supply Chain Breach Across 2,250 Tenants

An AI-driven attack swept through more than 2,250 Microsoft 365 tenants in a single coordinated campaign, marking a significant shift in how cyber threats are deployed. Microsoft’s security team revealed that the operation relied on automated agents to breach systems at a speed that traditional defenses struggled to match. The scale of the incident highlights the growing risk posed by artificial intelligence in the hands of sophisticated adversaries.

The actor behind the breach, identified as Storm-0940, is aligned with China and has been active since 2021. Microsoft noted that the group does not have known industry aliases and follows a naming convention for developing threats. The attack targeted 14 organizations across sectors including aerospace, defense, semiconductors, government, and think tanks. Microsoft clarified that the intrusion did not stem from a vulnerability in its own systems or products, but rather from unauthorized access to a third-party application.

The attackers utilized ARTEX, an open-source framework for agentic AI penetration testing. This system operates with large language model agents that conduct autonomous tests with minimal human interaction. The agents accelerated reconnaissance, password spraying, and the abuse of OAuth applications. Their relentless pace left defenders with little time to detect and respond to the intrusion.

Password spraying campaigns targeted 327 accounts across eight organizations, resulting in over 151,000 failed logons without a single success. On October 11, the peak of this activity saw 2,900 attempts per minute, with over 111,000 failures recorded in a day. Despite nearly 98% of these attempts being locked out, the attackers achieved their goals through a different vector.

By compromising credentials for multiple ConnectWise cloud apps, the AI agents signed into customer tenants from the same IP range. In one instance, more than 200 sign-ins occurred in under four minutes using just four application credentials. This method allowed the agents to bypass interactive user sign-ins and gain access to privileged roles within hours of initial targeting.

Huntress, a security firm, observed specific behaviors in one tenant on October 15, including an app adding itself to the top administrator role. The attackers also planted new secrets set to expire in 2028. By October 16, unauthorized sign-ins were confirmed in 162 tenants, and by the next day, nearly 1,000 tenants showed sign-in activity from the attacking IP, with over 300 succeeding. The systematic sweep of tenants suggested the use of a script working from a pre-defined target list.

The use of ARTEX distinguishes this attack from many traditional campaigns. The framework can utilize various AI models, and public reports this month linked it to breaches at South Korean financial institutions. CrowdStrike indicated that a suspect in those separate attacks was likely based in China and used ARTEX with Anthropic’s Claude Code. The developer of ARTEX, known as Autumn-27, stated the project would no longer be updated and would become closed source.

ConnectWise suspended several services, including Cloud Backup and SaaS Security, as a precautionary measure. The company has begun a phased restoration process, with recovery expected to take several days. There are currently no indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review recent activity logs.

Questions remain regarding how the initial ConnectWise credentials were stolen and exactly how many tenants suffered data exfiltration. The incident underscores the rapid evolution of cyber threats and the need for adaptive defense strategies in the face of AI-powered attacks.