AI Agents Accelerate China-Linked Supply Chain Breach

The most striking detail of the recent large-scale cyberattack is the speed at which attackers gained privileged access, with some operations reaching administrative levels in under three hours. This rapid escalation was driven by the deployment of ARTEX, an open-source agentic AI penetration testing framework, by a group identified as Storm-0940. The incident represents a significant shift in supply chain attacks, where automated intelligence has compressed the window for defenders to detect and respond to intrusions.

Microsoft detailed the mechanics of the breach in a security blog post, explaining that the threat actor utilized stolen credentials from the multi-tenant ConnectWise application. By authenticating as these applications without interactive user sign-ins, the group attempted logins across more than 2,250 distinct Microsoft 365 tenants. The use of ARTEX allowed the attackers to automate scanning, reconnaissance, and password spraying at a pace that traditional manual methods could not match, effectively operating around the clock with minimal human intervention.

The campaign targeted specific high-value sectors, including aerospace and defense, semiconductors, government entities, and think tanks, with a total of 14 industries listed. Storm-0940, a China-state aligned actor active since 2021, has no known industry aliases, suggesting it may still be developing its operational profile. Microsoft clarified that the attack did not stem from a vulnerability in its own systems but rather from the unauthorized use of third-party application identities.

In parallel to the application-based sign-ins, the group executed an automated password spray against 327 accounts across eight organizations. This resulted in over 151,000 failed logon attempts, with a peak of 2,900 attempts per minute on October 11. Although nearly 98% of these attempts were locked out, the sheer volume of activity highlighted the brute-force efficiency enabled by the AI agents. The lack of successful logins in this specific phase suggests the group relied more heavily on the compromised ConnectWise credentials for deeper access.

Once inside the tenants, the AI agents performed a range of operations, including Graph and directory reconnaissance, modification of application credentials, and changes to identities and privileged roles. In one notable instance on October 15, the security firm Huntress observed an application assigning itself to the top administrator role, a behavior that triggered specific Microsoft Defender alerts. The attackers also planted new secrets configured to expire in 2028, indicating an effort to establish long-term persistence within the compromised environments.

The methodical nature of the attack was evident in its execution pattern. Sign-ins swept through tenants in a sorted order, occurring just seconds apart, which security analysts interpreted as a script working from a pre-defined target list. By October 16, unauthorized sign-ins were confirmed for 162 tenants, and by October 17, nearly 1,000 Entra tenants showed sign-in activity from the attacking IP range, with over 300 of those sign-ins succeeding. This rapid expansion underscores the scalability of using AI agents for broad-scale intrusion.

The reliance on ARTEX marks a departure from traditional attack methodologies. The framework, which can utilize various AI models, has been linked to other breaches, including recent incidents at South Korean financial institutions. CrowdStrike noted that the suspect in those attacks was likely based in China and allegedly used ARTEX with Anthropic’s Claude Code. In response to its widespread use by threat actors, the developer of ARTEX, known as Autumn-27, announced that the project would no longer be updated and would transition to a closed-source model.

ConnectWise responded by suspending several services, including Cloud Backup, SaaS Security, and Cloud Management, as a precautionary measure. The company has initiated a phased restoration process, with recovery expected to take several days. While there are no current indicators that partner backup data was compromised, Microsoft advises customers to remain cautious. An affected app connection or a successful sign-in does not automatically mean data was exfiltrated, but organizations are urged to keep affected connections disabled until formal restoration instructions are provided.

This incident highlights the growing potency of AI-driven cyber operations, where speed and automation can overwhelm traditional defense timelines. For businesses in the New York and New Jersey regions, which host a dense concentration of financial and tech firms, the lesson is clear: supply chain vulnerabilities combined with autonomous AI tools can create critical exposure gaps. Security teams must now account for the rapid tempo of AI-assisted attacks in their detection and response strategies.