AI Agents: China-Linked Hackers Hit 2,250 Tenants in Supply Chain Strike

A China-aligned threat group known as Storm-0940 leveraged artificial intelligence to launch a massive supply chain attack that touched over 2,250 Microsoft 365 tenants. According to Microsoft, the operation utilized ARTEX, an open-source framework for agentic penetration testing, to automate reconnaissance and intrusion. The group managed to reach privileged access levels in less than three hours for some targets, demonstrating the speed at which these automated systems can operate.

The attack centered on unauthorized access to ConnectWise, a multi-tenant application. By stealing credentials for this app, the attackers could sign in to customer tenants without interactive user login. This method allowed the AI agents to bypass standard detection mechanisms. Microsoft noted that the activity did not stem from a vulnerability in its own systems but rather from the compromise of the third-party application's identities.

Automated password spraying also played a role in the campaign. The attackers targeted 327 accounts across eight organizations, generating more than 151,000 failed logons with no successful entries. At its peak on October 11, the system made 2,900 attempts per minute. While nearly 98% of these attempts were locked out, the use of stolen app credentials proved more effective. In one instance, four application credentials generated more than 200 sign-ins in under four minutes from the same IP range.

Storm-0940, active since 2021, targeted industries including aerospace, defense, semiconductors, government, and think tanks. A total of 14 sectors were listed. The group used the AI agents to perform directory operations, change app credentials, and modify privileged roles. Security firm Huntress observed one tenant where an app added itself to the top administrator role on October 15. This behavior triggered a specific alert in Microsoft Defender regarding self-assigned Global Administrator roles.

Huntress confirmed unauthorized sign-ins for 162 tenants by October 16. By the following day, nearly 1,000 Entra tenants showed sign-in activity from the attacking IP, with over 300 instances succeeding. The sequential nature of the attacks, occurring in sorted order just seconds apart, suggested a script working from a predefined target list. This methodical approach contrasts with traditional chaotic brute-force attacks, highlighting the precision of the AI-driven tools.

The use of ARTEX is significant because it is an open-source tool that can integrate with various AI models. Reports this month linked the framework to breaches at South Korean financial institutions. CrowdStrike indicated that a suspect in those separate attacks likely used ARTEX alongside Anthropic’s Claude Code. The developer of ARTEX, using the handle Autumn-27, announced on GitHub that the project would become closed source and cease public updates.

ConnectWise has suspended several services, including Cloud Backup and SaaS Security, as a precaution. The company is currently restoring services in phases, with full recovery expected to take several days. There are no indicators yet that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until official restoration instructions are issued and to review recent activity logs where possible.