Storm-0940 Leverages AI Agents to Accelerate Supply Chain Intrusion

The traditional timeline for supply chain attacks, where adversaries take days or weeks to move laterally through a network, has collapsed. By deploying open-source AI agents to automate reconnaissance and credential abuse, a China-state-aligned group known as Storm-0940 managed to breach privileged access in some Microsoft 365 tenants in less than three hours. This shift signals a new phase in cyber warfare where speed and automation, rather than manual exploitation, determine the success of an intrusion.

The scale of the operation is significant. Following unauthorized access to the ConnectWise multi-tenant application, the attackers attempted sign-ins across more than 2,250 Microsoft 365 tenants. By leveraging stolen credentials that authenticated as the applications themselves, the group bypassed the need for interactive user logins. This allowed the AI-driven agents to operate continuously with minimal human intervention, creating a pressure wave that left defenders with very little time to detect and respond to the unfolding threat.

A key driver of this efficiency was the use of ARTEX, an open-source agentic AI penetration testing framework. Microsoft’s analysis indicates that ARTEX, which utilizes LLM-driven agents, significantly accelerated the scanning, reconnaissance, and OAuth application abuse phases of the attack. In one specific incident on October 11, the automated password spraying campaign peaked at 2,900 attempts per minute, resulting in over 111,000 failed logons in a single day. Despite the volume, almost 98% of these attempts were locked out, highlighting the brute-force nature of the initial sweep.

Beyond simple password guessing, the attackers executed sophisticated identity manipulation. Using the credentials of multiple ConnectWise cloud apps, the agents signed into customer tenants from the same IP range. In a matter of minutes, more than 200 sign-ins were recorded using just four application credentials. Once inside, the agents performed directory operations, reconnaissance, and modifications to identities and privileged roles. In one notable case, an app assigned itself the Global Administrator role, a behavior that triggered specific alerts in Microsoft Defender.

The impact extended to sensitive sectors, including aerospace and defense, semiconductors, government, and think tanks, with 14 industries listed as targeted. Security firm Huntress confirmed unauthorized sign-ins for 162 tenants by October 16. By the following day, that number had surged to nearly 1,000 Entra tenants showing activity from the attacking IP, with more than 300 sign-ins succeeding. The systematic nature of the intrusion, with tenants accessed in sorted order seconds apart, suggested a scripted approach working from a pre-defined target list.

This incident is not an isolated anomaly but part of a broader trend. Public reporting this month linked ARTEX to breaches at South Korean financial institutions, with CrowdStrike suggesting the suspect in those cases was also China-based. The developer of ARTEX, known by the handle 'Autumn-27,' has announced that the project will no longer be updated and will transition to closed source. This move may affect the accessibility of the tool for other threat actors, though the technology has already demonstrated its widespread utility across different regions.

In response, ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services as a precautionary measure. A phased restoration process has begun, with recovery expected to take several days, and the company has not yet found indicators that partner backup data was compromised. Microsoft advises customers that a successful sign-in does not automatically mean data was exfiltrated, but recommends disabling affected app connections until formal restoration instructions are issued.

The deployment of AI agents in this attack underscores a critical vulnerability in modern enterprise architecture: the reliance on automated systems that can be manipulated by other automated systems. For California-based tech firms and their partners, this event serves as a stark reminder that the perimeter of defense must now account for machine-speed attacks. As organizations review their activity logs from this month, the focus will likely shift toward verifying the integrity of application credentials and the validity of automated administrative actions.

The outlook suggests a near-future where autonomous penetration testing becomes a standard tool for state-aligned actors. The speed at which Storm-0940 moved from initial access to privileged control challenges the assumption that human response time can effectively counteract automated intrusions. As the industry digests the implications of this supply chain breach, the conversation will likely center on how to secure the automated interfaces that now serve as the primary gateways to enterprise data.