2,250 Tenants Targeted in AI-Driven Supply Chain Breach

Supply chain attacks have long relied on manual exploitation, but a recent large-scale intrusion demonstrates how artificial intelligence is compressing the timeline between initial access and deep compromise. On October 23, Microsoft disclosed that a threat group known as Storm-0940 leveraged an open-source AI framework to execute a massive attack against ConnectWise, a multi-tenant application widely used for IT management.

The incident, which peaked on October 11, saw the group attempt sign-ins at more than 2,250 Microsoft 365 tenants. By utilizing stolen ConnectWise application credentials, the attackers authenticated as the applications themselves, bypassing the need for interactive user sign-ins. In several instances, the group achieved privileged access within less than three hours of targeting a specific tenant, a speed that traditional security monitoring often struggles to match.

The operational core of this attack was ARTEX, an agentic AI penetration testing framework. According to Microsoft, this system employs large language model-driven agents to conduct autonomous reconnaissance, scanning, and password spraying. These agents operate continuously with minimal human intervention, allowing for rapid execution of tasks such as OAuth application abuse. This automation leaves defenders with a narrow window to detect anomalies and respond before the threat actor escalates privileges.

Storm-0940, a China-state-aligned actor active since 2021, targeted industries including aerospace, defense, semiconductors, government, and think tanks. The group also conducted automated password spraying against 327 accounts across eight organizations, resulting in over 151,000 failed logons. While nearly 98% of these attempts were locked out, the use of application credentials allowed the AI agents to sign in from the same IP range, with some tenants experiencing more than 200 sign-ins in under four minutes.

Security firm Huntress observed specific behaviors in one tenant on October 15, where an application added itself to the top administrator role. This action triggered a Microsoft Defender alert and involved planting new secrets set to expire in 2028. By October 16, Huntress confirmed unauthorized sign-ins for 162 tenants. The following day, the number of Entra tenants showing sign-in activity from the attacking IP rose to nearly 1,000, with over 300 of those sign-ins succeeding. The sequential nature of the sweep, occurring seconds apart, suggested the use of a script working from a predefined target list.

The use of ARTEX marks a shift in threat actor capabilities, as the framework can utilize various AI models and is being adopted by groups in multiple regions. Public reports this month linked the tool to breaches at South Korean financial institutions, where the suspect allegedly used it with Anthropic’s Claude Code. In response to the growing threat, the developer of ARTEX announced on GitHub that the project would become closed-source and cease updates, a move that may impact future threat actor strategies.

ConnectWise has suspended several services, including Cloud Backup and SaaS Security, as a precautionary measure. The company has initiated a phased restoration process, with recovery expected to take several days. While there are currently no indicators that partner backup data was compromised, Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued. Organizations are encouraged to review activity logs from this month to identify any signs of unauthorized access, as a successful sign-in does not automatically confirm data exfiltration.

This event highlights the increasing sophistication of state-aligned actors who are integrating AI to accelerate the kill chain. As autonomous agents become more prevalent in offensive security operations, the standard for detection and response must evolve to keep pace with attacks that operate at machine speed.