ConnectWise Supply Chain Breach: Storm-0940 Uses ARTEX AI Agents for Rapid Credential Abuse
Microsoft attributes a high-speed supply chain breach to a China-linked group using an AI framework to automate access to thousands of cloud tenants.
Key points
- Storm-0940 used the ARTEX framework to attempt sign-ins at 2,900 per minute across more than 2,250 Microsoft 365 tenants.
- Attackers abused pre-approved ConnectWise Cloud Backup application permissions to bypass interactive user authentication requirements.
- Microsoft reported that some attacks achieved privileged cloud access in less than three hours, though many attempts failed.
Microsoft disclosed on October 21 that the China state-aligned actor Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application. The group utilized ARTEX, a Go-based agentic AI penetration testing framework, to accelerate reconnaissance and credential abuse. This attack vector bypassed the need for interactive user sign-ins by exploiting permissions already granted to the backup service within victim environments.
How it unfolded
- On October 16, ConnectWise issued a security advisory regarding the breach, while Huntress published an initial account confirming breaches at 162 tenants.
- Between October 10 and 14, Storm-0940 infrastructure generated over 151,000 failed logons against 327 accounts across eight organizations during password spraying.
- On October 21, Microsoft Threat Intelligence published detailed findings on Storm-0940’s use of ARTEX, noting the group has been active since at least 2021.
Who is affected
The campaign targeted hundreds of organizations globally, spanning sectors such as aerospace, defense, automotive, energy, financial services, government, and semiconductor manufacturing. Microsoft reported that Storm-0940 attempted to sign in to more than 2,250 Microsoft 365 tenants. While not every attempt succeeded, the sheer volume of activity created a compressed window for detection. The group specifically targeted environments connected to the compromised ConnectWise service, abusing the trust relationships established by the backup application.
The fix
No specific patch or update for the underlying ConnectWise vulnerability has been confirmed in the available reporting. Microsoft’s disclosure focuses on the attacker’s methodology and the rapidity of the credential abuse rather than a vendor-provided remediation for the backup application itself. Organizations are advised to monitor for anomalous sign-in activity and review application permissions until further guidance is issued by the vendor or cloud provider.
What made it possible
This incident illustrates the risk of over-privileged third-party applications in cloud environments. When a service like backup software is granted broad access, compromising it provides attackers with a trusted identity. Attackers can then use this identity to access data without needing user passwords. Security teams usually treat third-party app credentials as high-value targets. Check whether legacy applications retain excessive permissions. Restricting the scope of access
What to do and how to stay safe
- Application-layer attacks consume server resources without saturating network links, bypassing simple bandwidth limits.
- Reflection attacks amplify traffic volume, making the source appear legitimate while hiding the true attacker behind open resolvers.
- Mitigation requires distinguishing legitimate user traffic from malicious requests using behavioral analysis, not just volume thresholds.
DDoS attacks exploit resource exhaustion and require layered defense strategies for effective mitigation. Implement automated traffic rerouting and redundancy to maintain service availability during active attacks.
Step-by-step guide: DDoS Attack Mechanics: Answers to 10 Critical Questions
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
