AI-Driven Supply Chain Assault Seizes Privileged Access in Hours

The rapid evolution of cyber threats has reached a critical inflection point where automation dictates the pace of defense. Microsoft has disclosed that a China-state-aligned actor utilized an open-source AI framework to execute a sophisticated supply chain attack via ConnectWise.

The incident, attributed to the group known as Storm-0940, involved the deployment of ARTEX, a system of large language model-driven agents designed for autonomous penetration testing. By compromising credentials for multi-tenant applications, the actors attempted sign-ins across more than 2,250 Microsoft 365 tenants. Crucially, these sign-ins were authenticated as applications rather than interactive users, allowing the AI agents to operate with significant autonomy and speed.

The operational velocity of the attack left defenders with little time to react. In several instances, the group reached privileged access levels less than three hours after initial targeting. The AI agents worked around the clock with minimal human interaction, accelerating scanning, reconnaissance, and the abuse of OAuth applications. This automated approach effectively compressed the window for detection and response to near-zero in many cases.

Alongside the application-based intrusions, the group conducted aggressive password spraying campaigns. These automated guessing attempts targeted 327 accounts across eight organizations, resulting in over 151,000 failed logons. At its peak on October 11, the spray generated 2,900 attempts per minute. While nearly 98% of this activity resulted in lockouts, the sheer volume demonstrated the group’s capacity to brute-force credentials at an industrial scale.

The targeted sectors included aerospace and defense, semiconductors, government agencies, and think tanks, with 14 specific industries listed in the report. Microsoft clarified that the breach did not stem from a vulnerability in its own systems or products, but rather from the compromise of third-party application identities. The attackers used stolen ConnectWise credentials to sign in from the same IP range, executing over 200 sign-ins in under four minutes using just four application credentials.

Security firm Huntress observed specific malicious behaviors, such as an application assigning itself to the top administrator role in one tenant on October 15. This action triggered a specific alert in Microsoft Defender. By October 16, Huntress confirmed unauthorized sign-ins in 162 tenants, a number that grew to nearly 1,000 Entra tenants with successful sign-ins from the attacking IP by the following day. The systematic, sorted-order progression of the attacks suggested the use of a script working from a predefined target list.

The use of ARTEX distinguishes this campaign from traditional attacks, as the framework can utilize any AI model. Public reporting this month has linked similar technology to breaches at South Korean financial institutions, with suspects allegedly using the framework with Anthropic’s Claude Code. The developer of ARTEX, identified by the handle “Autumn-27,” announced on GitHub that the project would cease updates and transition to closed source, potentially altering the landscape for both attackers and defenders.

ConnectWise has suspended several cloud services as a precaution and initiated a phased restoration process expected to take several days. The company has not found indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review recent activity logs to assess potential exposure.

As AI agents become more central to offensive cybersecurity strategies, the integration of tools like ARTEX signals a shift toward faster, less human-dependent intrusion methods. Organizations relying on third-party application integrations must now account for the increased speed and scale of potential attacks on these supply chain dependencies.