AI Agents Drive Massive Supply Chain Intrusion

Microsoft disclosed that a China-state-aligned threat group deployed autonomous AI agents to execute a large-scale supply chain attack against ConnectWise customers.

The actor, identified as Storm-0940, leveraged an open-source framework called ARTEX to automate penetration testing tasks. This tool utilizes large language models to run autonomous scans, reconnaissance, and password spraying with minimal human input. Microsoft noted that the system operates continuously, leaving defenders with limited time to detect and respond to the intrusion. The attack began with unauthorized access to the multi-tenant ConnectWise application. Using stolen credentials from this app, the attackers authenticated as the service rather than individual users. This allowed them to attempt sign-ins across more than 2,250 Microsoft 365 tenants. In some cases, privileged access was achieved in less than three hours after initial targeting.

The campaign targeted industries including aerospace, defense, semiconductors, government, and think tanks, with a total of 14 listed sectors. A separate password spraying campaign targeted 327 accounts across eight organizations, resulting in over 151,000 failed logins. The peak activity occurred on October 11, when the system attempted 2,900 logins per minute. Despite high volume, nearly 98% of these attempts were locked out. However, the AI agents used four application credentials to sign in to customer tenants from the same IP range. They executed over 200 sign-ins in under four minutes. Actions within these tenants included directory operations, reconnaissance, and changes to privileged roles and identities.

Security firm Huntress observed specific malicious behaviors in one tenant on October 15. The attacker added an application to the top administrator role, triggering a specific Microsoft Defender alert. The attackers also planted new secrets set to expire in 2028. By October 16, Huntress confirmed unauthorized sign-ins for 162 tenants. The following day, almost 1,000 Entra tenants showed sign-in activity from the attacking IP address, with more than 300 succeeding. The sequential nature of the sweep indicated the use of a script working from a pre-defined target list.

The use of ARTEX distinguishes this event from traditional attacks. The framework can integrate various AI models, and similar technology has been linked to breaches at South Korean financial institutions. The developer of ARTEX announced on GitHub that the project would become closed source and stop receiving updates. ConnectWise suspended several services as a precaution and has begun a phased restoration process. Recovery is expected to take several days. Microsoft advised customers to keep affected app connections disabled and review recent logs to assess potential impact.