AI Agents Accelerate Supply Chain Intrusion Across 2,250 Microsoft Tenants

The deployment of autonomous artificial intelligence in cyberattacks has moved from theoretical risk to operational reality, as a China-aligned group used AI agents to breach thousands of corporate environments with unprecedented speed. Microsoft’s security team has detailed how the actor, known as Storm-0940, utilized ARTEX, an open-source agentic framework, to execute a large-scale supply chain attack via the ConnectWise platform. The operation involved unauthorized access to multi-tenant applications, allowing the group to attempt sign-ins at over 2,250 Microsoft 365 tenants using stolen credentials that authenticated without interactive user involvement.

The timeline of the intrusion reveals a rapid escalation that challenges traditional detection models. Storm-0940, active since 2021 and described as a developing actor with no industry aliases, targeted sectors including aerospace, defense, semiconductors, government, and think tanks. By October 11, the peak of password spraying activity saw 2,900 failed attempts per minute, totaling more than 111,000 for the day. While 98% of these attempts were locked out, the group’s control over ConnectWise cloud app identities allowed them to bypass these hurdles. Using just four application credentials, the AI agents executed over 200 sign-ins within four minutes from the same IP range, with some tenants achieving privileged access in less than three hours.

The use of ARTEX, a system of LLM-driven agents designed for autonomous penetration testing, significantly accelerated scanning, reconnaissance, and OAuth abuse. According to Microsoft, these agents operate continuously with minimal human intervention, leaving defenders with little time to react. The attack was not the result of a vulnerability in Microsoft’s own systems but rather an exploitation of third-party application credentials. In one instance on October 15, security firm Huntress observed an app adding itself to the top administrator role, a behavior that triggered specific Defender alerts. By October 17, nearly 1,000 Entra tenants showed sign-in activity from the attacking IP, with over 300 succeeding, suggesting a scripted approach working through a sorted target list.

The broader implications of this incident are compounded by the recent shift in the ARTEX project’s status. The framework’s developer, operating under the handle Autumn-27, announced that the project will no longer be updated and will transition to closed source. This comes as public reports link similar AI-driven breaches to South Korean financial institutions, with CrowdStrike indicating the suspect in those cases likely used ARTEX with Anthropic’s Claude Code. The convergence of open-source AI tools and state-aligned actors suggests a new phase in supply chain attacks where automation reduces the time-to-impact for defenders.

ConnectWise has suspended several services, including Cloud Backup and SaaS Security, as a precautionary measure. A phased restoration process has begun, with full recovery expected to take several days. While there are no current indicators that partner backup data was compromised, Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued. The incident underscores the urgency for organizations to review recent activity logs and reassess their reliance on third-party application credentials in an era where AI agents can execute complex intrusions with minimal human oversight.