AI Agents Accelerate Supply Chain Breach Across 2,250 Business Tenants

The traditional race between hackers and defenders has just been skewed by artificial intelligence. A state-aligned threat group from China recently executed a massive supply chain attack that leveraged autonomous AI agents to move with unprecedented speed. By exploiting a popular business application, the attackers attempted to sign into over 2,250 separate Microsoft 365 tenants. In some cases, they secured privileged access to these systems in under three hours, a timeline that leaves security teams with very little room to react.

The attack relied on a framework called ARTEX, an open-source tool designed for automated penetration testing. Microsoft describes the system as a collection of large language model-driven agents that conduct autonomous security tests. These agents do not require constant human oversight; instead, they work around the clock to scan networks, guess passwords, and abuse application credentials. This automation allowed the group to accelerate reconnaissance and attack phases to a pace that traditional manual methods could not match.

The primary vector for the breach was ConnectWise, a multi-tenant application used for business management. After gaining unauthorized access to this platform, the attackers used stolen application credentials to authenticate as the software itself. This method, known as OAuth application abuse, allowed the AI agents to sign in without a user typing in a password. The activity was highly automated, with one instance showing more than 200 sign-ins occurring within four minutes using just four different application credentials.

Simultaneously, the group launched a massive password spraying campaign. This technique involves trying a small number of common passwords against many different user accounts. The attackers targeted 327 accounts across eight organizations, generating more than 151,000 failed login attempts. At its peak on October 11, the system made 2,900 attempts per minute. While almost 98% of these attempts were locked out, the volume was high enough to create noise and confusion in security monitoring systems.

The targets of this operation included high-value industries such as aerospace, defense, semiconductors, and government agencies. Fourteen specific industries were listed as targets. In one notable incident on October 15, a security firm observed an application adding itself to the top administrator role within a tenant. The attackers also planted new digital secrets configured to expire in 2028, a tactic intended to maintain long-term access. By October 17, nearly 1,000 tenants showed sign-in activity from the attackers' IP range.

The use of ARTEX is significant because it is an open-source tool that can utilize various AI models. The framework’s developer recently announced that the project would become closed source and cease public updates. Other recent breaches, including those at South Korean financial institutions, have also been linked to this technology. This suggests that threat actors globally are adopting these autonomous AI tools to enhance their capabilities against corporate infrastructure.

In response to the incident, ConnectWise suspended several of its cloud services, including backup and management tools, as a precaution. The company has begun a phased restoration process, with full recovery expected to take several days. So far, there are no indicators that partner backup data was compromised. Microsoft advises customers to keep affected application connections disabled until formal restoration instructions are issued and to review recent activity logs to identify any unauthorized actions.