AI agents speed up massive supply chain attack on thousands of businesses

A China-aligned hacking group used artificial intelligence to launch a major attack on a widely used business software, impacting thousands of companies. This attack was significant because it involved AI agents that worked around the clock with little human interaction, allowing the hackers to carry out tasks quickly and efficiently. The hackers gained access to a multi-tenant application and used stolen credentials to attempt sign-ins at more than 2,250 Microsoft 365 tenants, with some achieving privileged access in under three hours. The use of AI sped up the entire process, making it harder for defenders to detect and respond in time.

The attack began when the hackers stole credentials from the business software, which allowed them to carry out a large-scale supply chain attack. The hackers used a system of AI agents that run an autonomous penetration test, which enabled them to carry out tasks like password spraying and OAuth application abuse at an unprecedented pace. The hackers targeted 327 accounts across eight organizations with more than 151,000 failed logons, and the attack was so fast that defenders had little time to react. The use of AI agents allowed the hackers to carry out tasks with little human interaction, making the attack even more efficient.

The attack was so large that it impacted businesses in industries like aerospace and defense, semiconductor, and government. The hackers used the AI agents to carry out password spraying, which targeted 327 accounts across eight organizations with more than 151,000 failed logons, and the attack was so fast that defenders had little time to react. The hackers used the AI agents to carry out tasks like password spraying and OAuth application abuse at an unprecedented pace, which made the attack even more efficient. The hackers gained access to a multi-tenant application and used stolen credentials to attempt sign-ins at more than 2,250 Microsoft 365 tenants, with some achieving privileged access in under three hours.

The hackers used the AI agents to carry out password spraying, which targeted 327 accounts across eight organizations with more than 151,000 failed logons, and the attack was so fast that defenders had little time to react. The hackers used the AI agents to carry out tasks like password spraying and OAuth application abuse at an unprecedented pace, which made the attack even more efficient. The hackers gained access to a multi-tenant application and used stolen credentials to attempt sign-ins at more than 2,250 Microsoft 365 tenants, with some achieving privileged access in under three hours. The use of AI sped up the entire process, making it harder for defenders to detect and respond in time.

The attack was so large that it impacted businesses in industries like aerospace and defense, semiconductor, and government. The hackers used the AI agents to carry out password spraying, which targeted 327 accounts across eight organizations with more than 151,000 failed logons, and the attack was so fast that defenders had little time to react. The hackers used the AI agents to carry out tasks like password spraying and OAuth application abuse at an unprecedented pace, which made the attack even more efficient. The hackers gained access to a multi-tenant application and used stolen credentials to attempt sign-ins at more than 2,250 Microsoft 365 tenants, with some achieving privileged access in under three hours. The use of AI sped up the entire process, making it harder for defenders to detect and respond in time.