Supply Chain Shock: AI Agents Accelerate Attack on Enterprise SaaS

For enterprise IT managers and business owners relying on cloud-based management tools, the operational rhythm was disrupted this week as a major service provider halted key offerings to contain a sophisticated intrusion. The incident highlights a new risk profile in the software supply chain, where automated artificial intelligence agents can execute complex breaches at a speed that traditional defense mechanisms struggle to match. This shift moves the threat landscape from slow, manual exploitation to rapid, autonomous scanning, forcing organizations to re-evaluate their response times and security architectures.

The scale of the operation is significant in both volume and velocity. According to data released by Microsoft, the attacking group attempted sign-ins across more than 2,250 distinct Microsoft 365 tenants. The operation utilized stolen credentials from ConnectWise applications to authenticate without interactive user logins. In several instances, the attackers achieved privileged access to tenant environments in less than three hours after initial targeting. Additionally, automated password spraying campaigns targeted 327 accounts across eight organizations, generating over 151,000 failed login attempts, though these specific attempts did not result in successful entries.

The entity behind the incursion is identified as Storm-0940, a China-state-aligned actor active since 2021 that lacks known industry aliases. The group targeted 14 organizations spanning aerospace and defense, semiconductor manufacturing, government agencies, and think tanks. Microsoft clarified that the breach did not stem from a vulnerability within its own systems or products, but rather from the compromise of third-party application credentials. The attack leveraged ARTEX, an open-source agentic AI framework designed for autonomous penetration testing, which allowed the agents to conduct reconnaissance and exploit OAuth applications with minimal human intervention.

At the peak of the activity on October 11, the password spraying operation reached a rate of 2,900 attempts per minute, totaling over 111,000 failures that day. While nearly 98% of these attempts were locked out, the attackers shifted tactics by using compromised ConnectWise app credentials. From a single IP range, the AI agents executed more than 200 sign-ins in under four minutes using just four application credentials. Within the affected tenants, the agents performed directory operations, reconnaissance, and modifications to privileged roles and identities, indicating a systematic effort to establish deep access.

Security firm Huntress provided visibility into the intrusions, confirming unauthorized sign-ins for 162 tenants by October 16. By the following day, the number of Entra tenants showing activity from the attacking IP rose to nearly 1,000, with over 300 successful logins. In one specific tenant, an application added itself to the top administrator role, a behavior that triggered alerts in Microsoft Defender. The attackers also planted new secrets with expiration dates set for 2028, suggesting an intent for long-term persistence. The sequential, sorted order of the tenant sweeps, occurring seconds apart, pointed to a script working from a predefined target list.

The use of ARTEX distinguishes this campaign from traditional manual attacks, as the framework can utilize various AI models to operate continuously. Recent public reporting has linked similar AI-driven techniques to breaches at South Korean financial institutions, with CrowdStrike noting that a suspect in those cases likely used ARTEX alongside Anthropic’s Claude Code. In response to the widespread usage by threat actors, the developer of ARTEX, known as “Autumn-27,” announced on GitHub that the project would cease updates and transition to closed-source status, a move that may alter the open-source security landscape.

ConnectWise has suspended its Cloud Backup, SaaS Security, and Cloud Management services as a precautionary measure. The company has initiated a phased restoration process, with recovery expected to take several days, and currently has no indicators that partner backup data was compromised. Microsoft advises customers to keep affected app connections disabled until formal restoration instructions are issued and to review recent activity logs. The incident underscores the growing financial and operational stakes for businesses that depend on third-party SaaS integrations for their core infrastructure.