Autonomous Breaches: AI Agents Accelerate Supply Chain Intrusions

The core tension in this recent cybersecurity incident lies in the speed versus detection gap: as attackers deploy artificial intelligence to automate intrusion steps, defenders are left with shrinking windows to identify and block breaches. This dynamic was starkly illustrated in a massive supply chain attack that exploited a widely used IT management tool, allowing a threat group to move through corporate networks with unprecedented velocity.

Microsoft has confirmed that the actor, identified as Storm-0940, utilized ARTEX, an open-source agentic AI penetration testing framework. This tool consists of large language model-driven agents capable of running autonomous tests. By leveraging these agents, the group significantly accelerated the processes of scanning, reconnaissance, and the exploitation of application credentials. The result was a campaign that attempted sign-ins to more than 2,250 Microsoft 365 tenants, with some instances of privileged access achieved in under three hours.

The scale of the automated effort was substantial. The attackers executed password spraying attacks against 327 accounts across eight organizations, generating over 151,000 failed logon attempts without a single success. At its peak on October 11, the system registered 2,900 attempts per minute, totaling more than 111,000 that day. While 98% of these attempts were locked out, the efficiency of the AI agents allowed them to work around the clock with minimal human interaction, a pace that leaves little time for traditional defensive measures.

Storm-0940, a China-state-aligned entity active since 2021, targeted specific high-value industries including aerospace and defense, semiconductors, government, and think tanks. Microsoft clarified that the initial access was not due to a vulnerability in its own systems, but rather unauthorized access to the multi-tenant ConnectWise application. The stolen ConnectWise credentials allowed the attackers to authenticate as the applications themselves, bypassing the need for interactive user sign-ins.

The operational details reveal a systematic approach. Using four specific application credentials, the agents performed more than 200 sign-ins in under four minutes from the same IP range. Within compromised tenants, the group performed directory operations, changed app credentials, and modified privileged roles. In one notable instance on October 15, the security firm Huntress observed an application assigning itself the top administrator role, a behavior that triggered specific alerts in Microsoft Defender.

By October 16, Huntress had confirmed unauthorized sign-ins for 162 tenants. The following day, that number jumped to nearly 1,000 Entra tenants showing activity from the attacking IP, with over 300 sign-ins succeeding. The pattern of the sweep, moving through tenants in sorted order just seconds apart, indicated that a script was working directly from a target list, further highlighting the automated nature of the intrusion.

The use of ARTEX marks a shift in threat landscape trends. The framework’s developer, known online as Autumn-27, announced that the project would cease updates and move to closed source. Meanwhile, ConnectWise suspended several of its cloud services as a precaution. While the company has begun phased restoration and sees no immediate signs of data compromise in partner backups, Microsoft advises customers to keep affected app connections disabled until further notice and to review logs for recent activity.

The stakes for organizations in the region and beyond are high, as the incident demonstrates that AI-driven agents can compress the timeline of a breach from days to hours. With public reports linking similar tools to breaches at South Korean financial institutions, the reliance on open-source AI for penetration testing is becoming a critical vector for state-aligned hackers seeking efficient, large-scale access to corporate data.