AI Agents Attack: 2,250 Tenants Targeted in Supply Chain Breach

More than 2,250 Microsoft 365 tenants were targeted in a massive supply chain attack that utilized autonomous artificial intelligence agents. This operation, attributed to the China-state-aligned group known as Storm-0940, represents a significant shift in how cyber threats are executed against enterprise infrastructure. The attack exploited unauthorized access to ConnectWise, a multi-tenant application, to launch a coordinated wave of sign-in attempts across a wide range of organizations.

The attackers employed ARTEX, an open-source framework designed for agentic penetration testing. According to Microsoft, this system uses large language model driven agents to run autonomous tests. The technology allowed the group to perform scanning, reconnaissance, and password spraying with minimal human interaction. The speed of these automated operations left defenders with very little time to detect and respond to the intrusion. At the peak of the campaign on October 11, the system executed 2,900 password attempts per minute, totaling more than 111,000 failures that day. Despite this volume, no password guesses succeeded, and nearly 98 percent of the activity resulted in account lockouts.

While the password spray was largely unsuccessful, the attackers achieved a different kind of success by using stolen ConnectWise application credentials. These credentials allowed the AI agents to authenticate as the applications themselves, bypassing the need for interactive user sign-ins. In some instances, the agents reached privileged access levels within three hours of initial targeting. Over four minutes, they generated more than 200 sign-ins using just four application credentials. The operations included directory changes, reconnaissance, and modifications to user identities and roles.

The group targeted fourteen industries, including aerospace, defense, semiconductors, and government think tanks. The attack did not stem from a vulnerability in Microsoft’s own systems but rather from the compromised third-party provider. Huntress, a security firm, observed one tenant where an application added itself to the top administrator role on October 15. The firm confirmed unauthorized sign-ins for 162 tenants by October 16 and nearly 1,000 tenants by the following day. The sequential nature of the attacks, occurring in sorted order just seconds apart, suggested the use of a script working from a pre-defined target list.

The use of ARTEX marks a departure from traditional manual attacks. The framework can utilize various AI models, and recent reports link similar technology to breaches at South Korean financial institutions. The developer of ARTEX, identified by the handle Autumn-27, announced that the project would no longer be updated and would become closed source. ConnectWise suspended several of its cloud services as a precaution and began a phased restoration process. Recovery is expected to take several days, with no current indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued.

This incident highlights the growing role of automated tools in cyber operations. The ability of AI agents to work around the clock and adapt to defenses poses new challenges for IT teams. As more organizations adopt third-party cloud applications, the risk of supply chain attacks increases. Security experts are watching how this framework is used in future campaigns to understand its full impact on enterprise security.